Exam PT0-002 topic 1 question 188 discussion

C. Stacked queries The string entered by the tester is an example of a stacked query, also known as a multiple query injection. It attempts to inject an additional SQL query into an existing one by stacking the new query on top of the original one. This can be used to extract sensitive information from the database, such as usernames and passwords. A blind SQL injection is when the attacker is able to send commands to the database but is unable to see the result of these commands, usually due to the lack of error messages. Boolean SQL injection is a type of SQL injection where the attacker will insert a payload that will cause a query to return true or false. Error-based SQL injection is a type of SQL injection where the attacker sends payloads that cause the database to return error messages.

Why C. Stacked queries is correct: • Stacked queries involve adding additional SQL statements to the original query, separated by a semicolon (;). This technique allows the attacker to execute multiple queries in a single request. The provided string 1;SELECT Username, Password FROM Users; is a clear example of this approach, as it combines an initial input value (1) with an additional SQL query. Conclusion: The penetration tester is using a stacked queries SQL injection attack. Therefore, option C is the correct answer.

The query provided by the penetration tester is attempting to execute more than one SQL command in a single call. This is known as stacking queries, where multiple SQL queries are separated by a semicolon. So the correct answer is: C. Stacked queries

C. Stacked queries is the injection attack the penetration tester is using. Stacked queries, also known as Multi-Statement or Batched Queries, are a type of SQL injection attack that combines multiple SQL statements into one query. This attack can be used to bypass authentication and authorization processes by allowing an attacker to gain access to restricted data.

This is because the attacker is attempting to execute multiple SQL statements within the same query by using the semicolon (;) as a separator. The first statement is a valid login attempt (i.e., "1" is the username), and the second statement attempts to extract sensitive information (i.e., the username and password of all users).

cccccccc

Ithink D Error based

Blind SQL

This is a SQL UNION attack. I don't see an answer for this.