Eccouncil ECSAv10 Exam - Topic 6 Question 79 Discussion

Actual exam question for Eccouncil's ECSAv10 exam

Question #: 79
Topic #: 6

SQL injection attacks are becoming significantly more popular amongst hackers and there has been an estimated 69 percent increase of this attack type.

This exploit is used to great effect by the hacking community since it is the primary way to steal sensitive data from web applications. It takes advantage of non-validated input vulnerabilities to pass SQL commands through a web application for execution by a back-end database.

The below diagram shows how attackers launched SQL injection attacks on web applications.

Which of the following can the attacker use to launch an SQL injection attack?

ABlah' ''2=2 --''

BBlah' and 2=2 --

CBlah' and 1=1 --

DBlah' or 1=1 --

Show Suggested Answer

Suggested Answer: D

by Tora at Sep 14, 2024, 11:08 PM

Limited Time Offer

25%

Off

Get Premium ECSAv10 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Amie

6 months ago

All those options look like they could work for an attack.

upvoted 0 times

...

Jolanda

6 months ago

Not sure about that increase, seems a bit exaggerated.

upvoted 0 times

...

Boris

6 months ago

I think option C is the most effective for SQL injection.

upvoted 0 times

...

Frederick

7 months ago

SQL injection is super common, gotta validate inputs!

upvoted 0 times

...

Gayla

7 months ago

Wow, a 69% increase? That's crazy!

upvoted 0 times

...

Ocie

7 months ago

I recall a similar question where "Blah' ''2=2 --" was mentioned, but it seems less effective than the others listed here.

upvoted 0 times

...

Edelmira

7 months ago

I think "Blah' and 2=2 --" might work too, but I'm not as confident about that one.

upvoted 0 times

...

Hyun

7 months ago

I'm not entirely sure, but I feel like "Blah' or 1=1 --" could be a valid attack vector since it always evaluates to true.

upvoted 0 times

...

Wilda

8 months ago

I remember practicing SQL injection examples, and I think the "1=1" condition is a classic way to bypass authentication.

upvoted 0 times

...

Willard

8 months ago

This is a great question to test our understanding of SQL injection vulnerabilities. I'd approach it by carefully analyzing each of the provided options and thinking through how they could be used to exploit the application. The key is to identify the input that can inject malicious SQL commands.

upvoted 0 times

...

Diego

8 months ago

Okay, let's see here. The question is asking what the attacker can use to launch the SQL injection attack. Based on the options provided, I think the answer is D - 'Blah' or 1=1 --'. That looks like a classic SQL injection technique to me.

upvoted 0 times

...

Cheryll

8 months ago

Hmm, I'm a bit unsure about this one. The diagram is helpful, but I'm not totally clear on how the different SQL injection payloads work. I'll need to think this through carefully.

upvoted 0 times

...

Desmond

8 months ago

This looks like a classic SQL injection question. I'm pretty confident I can handle this one - the key is to identify the malicious input that can be used to exploit the application.

upvoted 0 times

...

Alfred

8 months ago

I'm a little confused by this question. There are a lot of technical details about SQL injection that I'm not super familiar with. I'll need to review my notes and try to understand the different injection techniques before I can confidently answer this.

upvoted 0 times

...

Oneida

2 years ago

Ha, SQL injection? That's like the hackers' version of a 'get out of jail free' card, am I right? I'm gonna have to go with D - 'Blah' or 1=1 --'. Seems like the most, uh, 'elegant' solution to me.

upvoted 0 times

...

Thea

2 years ago

Ooh, this is a tricky one. I'm gonna have to go with C - 'Blah' and 1=1 --'. It just seems like the most logical choice to me. Though, I have to admit, I'm kinda jealous of those hackers who get to play with all this cool stuff.

upvoted 0 times

Stephanie

2 years ago

Definitely, C is the way to go with this one.

upvoted 0 times

...

Yong

2 years ago

Yeah, C seems like the most logical choice out of all the options.

upvoted 0 times

...

Craig

2 years ago

I think C is the correct answer too. It just makes sense.

upvoted 0 times

...

Ruthann

2 years ago

D) Blah' or 1=1 --

upvoted 0 times

...

Vi

2 years ago

C) Blah' and 1=1 --

upvoted 0 times

...

Marica

2 years ago

B) Blah' and 2=2 --

upvoted 0 times

...

Maricela

2 years ago

A) Blah' ''2=2 --''

upvoted 0 times

...

Lenny

2 years ago

Antonio: Definitely, hackers are getting more creative with these attacks.

upvoted 0 times

...

Antonio

2 years ago

Yeah, that makes sense. It's a common SQL injection tactic.

upvoted 0 times

...

Michael

2 years ago

I think C is the right choice too. 'Blah' and 1=1 --'

upvoted 0 times

...

Chauncey

2 years ago

SQL injection, huh? Sounds like something a hacker would use to mess with a website. I'd go with option B - 'Blah' and 2=2 --'. Feels like the most straightforward way to sneak past those security checks.

upvoted 0 times

...

Lauran

2 years ago

I believe the attacker can use options A, B, C, and D to launch an SQL injection attack.

upvoted 0 times

...

Angelo

2 years ago

Ah, good ol' SQL injection! I remember learning about this in my cybersecurity class. The answer's gotta be D - 'Blah' or 1=1 --'. That's the classic way to exploit those non-validated inputs.

upvoted 0 times

Casie

2 years ago

Ah, good ol' SQL injection! I remember learning about this in my cybersecurity class. The answer's gotta be D - 'Blah' or 1=1 --'. That's the classic way to exploit those non-validated inputs.

upvoted 0 times

...