Examkin

Soru

Zorluk: KolayApplication and Software Vulnerabilities

A system administrator is reviewing web application event logs and discovers multiple database syntax errors generated by user input containing payload strings such as `' OR '1'='1`. Which of the following application vulnerabilities is the attacker attempting to exploit?

  1. SQL injectionCevap
  2. B
    Cross-site scripting (XSS)
  3. C
    Broken object level authorization
  4. D
    Buffer overflow

Cevap

SQL injection is the vulnerability being targeted.
SQL injection occurs when untrusted input is passed directly into a database query engine without adequate input validation or parameterization. The input payload `' OR '1'='1` forces a SQL boolean condition to always evaluate as true, manipulating the expected query execution flow.

Adım Adım Çözüm

1
Analyze the log entries provided in the scenario.
Identify database syntax errors caused by input string `' OR '1'='1`.
Recognizing database command manipulation patterns in user inputs helps identify web application attacks.
2
Determine which application vulnerability allows database syntax execution.
SQL injection occurs when user input fields accept unsanitized SQL commands.
Unsanitized user inputs passed directly into database queries allow attackers to manipulate standard SQL logic.

Anahtar Kavram

SQL Injection Identification
Bu soruyu puanla

Konular

Application and Software Vulnerabilities

Bu konudan daha fazla soru