Web Application Attacks and SQL Injection ECSS Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A penetration tester is testing a web application that does not display database errors or query results. The tester suspects SQL injection and wants to confirm it. Which of the following techniques is the most appropriate?

   • AUse an out-of-band payload to make the database send a DNS request.
   • BUse an error-based payload to trigger a database error.
   • CUse a boolean-based blind payload and compare responses.
   • DUse a UNION-based payload to extract data in the response.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A development team is remediating SQL injection vulnerabilities. The application is a legacy system that uses dynamic SQL in many places. The team has a tight deadline and limited budget. They must choose a mitigation strategy. Which of the following is the most effective strategy given the constraints?

   • AAdd input validation to all user inputs to block special characters.
   • BImplement a web application firewall (WAF) with a strict rule set to block SQL injection attempts.
   • CRefactor all dynamic SQL queries to use parameterized statements.
   • DUse a database account with least privilege to limit the impact of SQL injection.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   During a web application test, a penetration tester injects a payload into a search parameter. The application does not display any database error or the query result, but the response time increases significantly when the tester submits ' AND (SELECT COUNT(*) FROM users) > 1000 -- . Which type of SQL injection is the tester most likely exploiting?

   • AError-based SQL injection
   • BOut-of-band SQL injection (DNS exfiltration)
   • CBlind SQL injection (time-based)
   • DIn-band SQL injection (union-based)
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A developer is fixing a SQL injection vulnerability in a PHP application. The current code uses mysql_query() with string concatenation. Which of the following is the most secure replacement?

   • AUse a custom function to strip all non-alphanumeric characters from inputs.
   • BUse mysql_real_escape_string() on all user inputs.
   • CUse a stored procedure that concatenates the input inside the procedure.
   • DUse PDO with prepared statements and bound parameters.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A penetration tester is conducting a web application assessment for a client. The client has a strict policy: no automated scanning tools may be used, and all testing must be manual. The application is a large e-commerce platform with hundreds of input parameters. The tester has limited time. Which of the following is the most effective approach to maximize coverage while complying with the policy?

   • AFocus on the most critical parameters, such as login, search, and checkout, and manually test them thoroughly.
   • BRequest an extension of the testing window to manually test every parameter.
   • CUse a proxy tool to intercept and modify requests, but do not use any automated scanning features.
   • DUse a browser extension to automate the testing of all parameters.
   Reveal Solution Discussion Select an answer first