CS Professional · Artificial Intelligence, Data Analytics and Cyber Security - Laws and Practice · Cyber Security
An attacker enters the string ' OR '1'='1 into the login field of a company's web portal and gains access without a valid password, because the application inserts user input directly into its database query. What is this attack called and what is its root cause?
This is SQL injection. The application places unvalidated user input directly into a database query, so the attacker's string alters the query logic and bypasses authentication. The fix is input validation and parameterised queries, not cookie encryption or DNS controls.
- ACross-site scripting, caused by weak encryption of cookies
- BSQL injection, caused by failure to validate or parameterise user inputCorrect
- CPharming, caused by corrupted DNS records
- DSession hijacking, caused by predictable session identifiers
Explanation
Injecting SQL fragments into input that is concatenated into a query is SQL injection. The root cause is improper input validation and not using parameterised queries. Cross-site scripting instead injects scripts that run in other users' browsers.
Did you get it right without looking?
One question tells you little. A timed set on Cyber Security shows your real accuracy, how long you take and where you lose marks.
More Cyber Security questions
- An attacker silently positions himself between a customer's device and a bank's server on an unsecured public Wi-Fi network, reading and pos…
- A forensic examiner must collect evidence from a running server that is suspected to be compromised. Considering the order of volatility, wh…
- A company's risk register shows that a phishing attack on its payroll system has a high likelihood and a moderate impact. Management buys cy…
- A Mumbai-based firm's payment portal is flooded with millions of fake requests from many compromised computers, making it unavailable to gen…
- Under the CERT-In Directions issued in April 2022 under the Information Technology Act, 2000, within what time must a service provider, inte…
- During a forensic investigation, an examiner computes a hash value (such as SHA-256) of a seized disk image at acquisition and again before …