Free Preparation Discussions
MENU
The SecOps Group CAP Exam - Topic 16 Question 101 Discussion
Topic #: 16
Which SQL function can be used to read the contents of a file during manual exploitation of the SQL injection vulnerability in a MySQL database?
SQL injection vulnerabilities allow attackers to manipulate database queries, potentially accessing unauthorized data, including file contents, if the database supports such operations. In MySQL, the LOAD_FILE() function is specifically designed to read the contents of a file on the server where the database is hosted, provided the file exists, the database user has appropriate privileges (e.g., FILE privilege), and the file is readable. For example, SELECT LOAD_FILE('/etc/passwd') could extract the contents of the /etc/passwd file if exploitable.
Option A ('READ_FILE()'): This is not a valid MySQL function.
Option B ('LOAD_FILE()'): This is the correct function for reading file contents in MySQL, making it the right choice for exploitation.
Option C ('FETCH_FILE()'): This is not a recognized MySQL function.
Option D ('GET_FILE()'): This is also not a valid MySQL function.
The correct answer is B, aligning with the CAP syllabus under 'SQL Injection' and 'Database Security.'
Lynsey
16 hours agoShad
6 days agoEleni
11 days agoAide
16 days agoGennie
21 days agoKrystina
26 days agoDominque
1 month agoLettie
1 month agoShay
1 month agoTonja
2 months agoAleisha
2 months agoFletcher
2 months agoMalcom
2 months agoKelvin
2 months agoNikita
2 months agoShaquana
3 months agoDino
3 months agoDoyle
3 months agoMichel
3 months ago