ExamGecko
Question list
Search
Search

List of questions

Search

Related questions











Question 51 - 212-82 discussion

Report
Export

A web application www.movieabc.com was found to be prone to SQL injection attack. You are given a task to exploit the web application and fetch the user credentials. Select the UID which is mapped to user john in the database table.

Note:

Username: sam Pass: test

A.
5
Answers
A.
5
B.
3
Answers
B.
3
C.
2
Answers
C.
2
D.
4
Answers
D.
4
Suggested answer: D

Explanation:

4 is the UID that is mapped to user john in the database table in the above scenario. SQL injection is a type of web application attack that exploits a vulnerability in a web application that allows an attacker to inject malicious SQL statements into an input field, such as a username or password field, and execute them on the database server. SQL injection can be used to bypass authentication, access or modify sensitive data, execute commands, etc. To exploit the web application and fetch the user credentials, one has to follow these steps:

Open a web browser and type www.movieabc.com Press Enter key to access the web application.

Enter sam as username and test as password.

Click on Login button.

Observe that a welcome message with username sam is displayed.

Click on Logout button.

Enter sam' or '1'='1 as username and test as password.

Click on Login button.

Observe that a welcome message with username admin is displayed, indicating that SQL injection was successful.

Click on Logout button.

Enter sam'; SELECT * FROM users; – as username and test as password.

Click on Login button.

Observe that an error message with user credentials from users table is displayed.

The user credentials from users table are:

The UID that is mapped to user john is 4.

asked 18/09/2024
Juan Bueno
40 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first