MENU
Black-box testing is a method of software testing that examines the functionality of an application (e.g. what the software does) without peering into its internal structures or workings. Black-box testing is used to detect issues in SQL statements and to detect SQL injection vulnerabilities.
Most commonly, SQL injection vulnerabilities are a result of coding vulnerabilities during the Implementation/Development phase and will likely require code changes. Pen testers need to perform this testing during the development phase to find and fix the SQL injection vulnerability.
What can a pen tester do to detect input sanitization issues?
Suggested Answer: D
Get Premium ECSAv10 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
32 comments · newest first
PA
Pamella
11 months ago
Sending junk data can help, but it’s not as targeted as using quotes.
ST
Stanton
11 months ago
Surprised that single quotes are the go-to for catching unsanitized input!
JO
Joanna
11 months ago
I thought double quotes were more effective for testing input issues?
JE
Jesusita
12 months ago
Totally agree, it's essential for finding SQL injection flaws!
AR
Arthur
12 months ago
Black-box testing focuses on functionality, not internal code.
EL
Elli
1 year ago
I recall that using specific characters like the right square bracket can expose vulnerabilities, so option D might be a strong candidate for detecting sanitization issues.
LU
Luis
1 year ago
I practiced a similar question where we had to identify input types for testing, and I think sending junk data could help, but I'm not confident it's the best choice here.
LE
Lemuel
1 year ago
I'm not entirely sure, but I feel like double quotes might not be as effective as single quotes for SQL injection tests.
HA
Hannah
1 year ago
I remember discussing how single quotes can break SQL queries if they're not properly sanitized, so I think option A makes sense.
LE
Leota
1 year ago
I'm confident I can handle this. Sending malformed input is a classic way to check for SQL injection flaws, so I'll experiment with different special characters.
AL
Alysa
1 year ago
The question mentions that pen testers need to perform this testing during the development phase. I'll keep that in mind and focus on techniques that could be used early on.
VA
Vallie
1 year ago
Okay, I think I've got a good strategy. I'll start by trying single quotes, since that's a common way to detect unsanitized input.
NO
Norah
1 year ago
Hmm, I'm a bit unsure about the best approach here. Should I try different types of malicious input to see how the application handles them?
IL
Ilene
1 year ago
This question seems straightforward. I'll focus on the key details about black-box testing and SQL injection vulnerabilities.
GE
Genevieve
1 year ago
The Electronic Product Code seems like the most detailed and internationally recognized option here. I'm confident that's the right answer.
AD
Adell
1 year ago
I'm a bit confused on this one. Is it in the WFM Web for Agents or the WFM Configuration Utility? I'll need to review the WFM documentation to refresh my memory.
GE
Geoffrey
1 year ago
Ah, the DUAL table - I remember learning about this. I'm confident I can identify the two true statements here.
CA
Catarina
1 year ago
What, no option for ' or 1=1 '? That's the classic, folks. If that doesn't work, I'm just gonna start randomly mashing the keyboard until something breaks. Gotta keep 'em on their toes, right?
AN
Annelle
1 year ago
Junk data, huh? Sounds like a job for my special keyboard macro that spits out 10,000 characters in half a second. Bet that'll make the developers' heads spin!
CO
Cory
1 year ago
C) Send long strings of junk data, just as you would send strings to detect buffer overruns
LO
Louisa
1 year ago
B) Send double quotes as the input data to catch instances where the user input is not sanitized
LU
Lura
1 year ago
A) Send single quotes as the input data to catch instances where the user input is not sanitized
FE
Felicidad
1 year ago
Double quotes? Really? That's so 2000s. Everyone knows the right square bracket is where it's at these days. Gotta stay on top of the latest techniques, my friend.
LE
Lenna
1 year ago
D) Use a right square bracket (the '']'' character) as the input data to catch instances where the user input is used as part of a SQL identifier without any input sanitization
JE
Jesusita
1 year ago
B) Send double quotes as the input data to catch instances where the user input is not sanitized
MI
Mitsue
1 year ago
A) Send single quotes as the input data to catch instances where the user input is not sanitized
ED
Edna
2 years ago
Hmm, that makes sense too. It's important to test different types of input data to catch sanitization issues.
BE
Berry
2 years ago
I disagree, I believe the correct answer is D) Use a right square bracket as the input data.
AR
Aracelis
2 years ago
Ah, the classic SQL injection testing! I'm all over this. Single quotes are the way to go - that's the standard approach to uncover unsanitized input.
GL
Glory
1 year ago
User 2
LA
Lamonica
1 year ago
User 1
ED
Edna
2 years ago
I think the answer is A) Send single quotes as the input data.