Eccouncil ECSAv10 Exam - Topic 4 Question 67 Discussion

Actual exam question for Eccouncil's ECSAv10 exam

Question #: 67
Topic #: 4

Black-box testing is a method of software testing that examines the functionality of an application (e.g. what the software does) without peering into its internal structures or workings. Black-box testing is used to detect issues in SQL statements and to detect SQL injection vulnerabilities.

Most commonly, SQL injection vulnerabilities are a result of coding vulnerabilities during the Implementation/Development phase and will likely require code changes. Pen testers need to perform this testing during the development phase to find and fix the SQL injection vulnerability.

What can a pen tester do to detect input sanitization issues?

ASend single quotes as the input data to catch instances where the user input is not sanitized

BSend double quotes as the input data to catch instances where the user input is not sanitized

CSend long strings of junk data, just as you would send strings to detect buffer overruns

DUse a right square bracket (the '']'' character) as the input data to catch instances where the user input is used as part of a SQL identifier without any input sanitization

Show Suggested Answer

Suggested Answer: D

by Aracelis at Apr 21, 2024, 04:06 AM

Limited Time Offer

25%

Off

Get Premium ECSAv10 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Pamella

3 months ago

Sending junk data can help, but it’s not as targeted as using quotes.

upvoted 0 times

...

Stanton

3 months ago

Surprised that single quotes are the go-to for catching unsanitized input!

upvoted 0 times

...

Joanna

3 months ago

I thought double quotes were more effective for testing input issues?

upvoted 0 times

...

Jesusita

4 months ago

Totally agree, it's essential for finding SQL injection flaws!

upvoted 0 times

...

Arthur

4 months ago

Black-box testing focuses on functionality, not internal code.

upvoted 0 times

...

Elli

4 months ago

I recall that using specific characters like the right square bracket can expose vulnerabilities, so option D might be a strong candidate for detecting sanitization issues.

upvoted 0 times

...

Luis

4 months ago

I practiced a similar question where we had to identify input types for testing, and I think sending junk data could help, but I'm not confident it's the best choice here.

upvoted 0 times

...

Lemuel

4 months ago

I'm not entirely sure, but I feel like double quotes might not be as effective as single quotes for SQL injection tests.

upvoted 0 times

...

Hannah

5 months ago

I remember discussing how single quotes can break SQL queries if they're not properly sanitized, so I think option A makes sense.

upvoted 0 times

...

Leota

5 months ago

I'm confident I can handle this. Sending malformed input is a classic way to check for SQL injection flaws, so I'll experiment with different special characters.

upvoted 0 times

...

Alysa

5 months ago

The question mentions that pen testers need to perform this testing during the development phase. I'll keep that in mind and focus on techniques that could be used early on.

upvoted 0 times

...

Vallie

5 months ago

Okay, I think I've got a good strategy. I'll start by trying single quotes, since that's a common way to detect unsanitized input.

upvoted 0 times

...

Norah

5 months ago

Hmm, I'm a bit unsure about the best approach here. Should I try different types of malicious input to see how the application handles them?

upvoted 0 times

...

Ilene

5 months ago

This question seems straightforward. I'll focus on the key details about black-box testing and SQL injection vulnerabilities.

upvoted 0 times

...

Genevieve

5 months ago

The Electronic Product Code seems like the most detailed and internationally recognized option here. I'm confident that's the right answer.

upvoted 0 times

...

Adell

5 months ago

I'm a bit confused on this one. Is it in the WFM Web for Agents or the WFM Configuration Utility? I'll need to review the WFM documentation to refresh my memory.

upvoted 0 times

...

Geoffrey

5 months ago

Ah, the DUAL table - I remember learning about this. I'm confident I can identify the two true statements here.

upvoted 0 times

...

Catarina

10 months ago

What, no option for ' or 1=1 '? That's the classic, folks. If that doesn't work, I'm just gonna start randomly mashing the keyboard until something breaks. Gotta keep 'em on their toes, right?

upvoted 0 times

...

Annelle

10 months ago

Junk data, huh? Sounds like a job for my special keyboard macro that spits out 10,000 characters in half a second. Bet that'll make the developers' heads spin!

upvoted 0 times

Cory

8 months ago

C) Send long strings of junk data, just as you would send strings to detect buffer overruns

upvoted 0 times

...

Louisa

9 months ago

B) Send double quotes as the input data to catch instances where the user input is not sanitized

upvoted 0 times

...

Lura

9 months ago

A) Send single quotes as the input data to catch instances where the user input is not sanitized

upvoted 0 times

...

Felicidad

10 months ago

Double quotes? Really? That's so 2000s. Everyone knows the right square bracket is where it's at these days. Gotta stay on top of the latest techniques, my friend.

upvoted 0 times

Lenna

9 months ago

D) Use a right square bracket (the '']'' character) as the input data to catch instances where the user input is used as part of a SQL identifier without any input sanitization

upvoted 0 times

...

Jesusita

9 months ago

B) Send double quotes as the input data to catch instances where the user input is not sanitized

upvoted 0 times

...

Mitsue

9 months ago

A) Send single quotes as the input data to catch instances where the user input is not sanitized

upvoted 0 times

...

Edna

10 months ago

Hmm, that makes sense too. It's important to test different types of input data to catch sanitization issues.

upvoted 0 times

...

Berry

10 months ago

I disagree, I believe the correct answer is D) Use a right square bracket as the input data.

upvoted 0 times

...

Aracelis

10 months ago

Ah, the classic SQL injection testing! I'm all over this. Single quotes are the way to go - that's the standard approach to uncover unsanitized input.

upvoted 0 times

Glory

9 months ago

User 2

upvoted 0 times

...

Lamonica

10 months ago

User 1

upvoted 0 times

...

Edna

11 months ago

I think the answer is A) Send single quotes as the input data.

upvoted 0 times

...