ExamTopics Logo
Mail Us[email protected]
Menu
Eccouncil Discussions
exam questions

Exam 312-50v13 All Questions

View all questions & answers for the 312-50v13 exam
Go to Exam

Exam 312-50v13 topic 1 question 218 discussion

Actual exam question from ECCouncil's 312-50v13
Question #: 218
Topic #: 1
[All 312-50v13 Questions]

An ethical hacker is testing the security of a website's database system against SQL Injection attacks. They discover that the IDS has a strong signature detection mechanism to detect typical SQL injection patterns. Which evasion technique can be most effectively used to bypass the IDS signature detection while performing a SQL Injection attack?

  • A. Employ IP fragmentation to obscure the attack payload
  • B. Implement case variation by altering the case of SQL statements
  • C. Leverage string concatenation to break identifiable keywords
  • D. Use Hex encoding to represent the SQL query string
Show Suggested Answer Hide Answer
Suggested Answer: D 🗳️
by NikoTomas at March 25, 2025, 9:03 p.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
NikoTomas
1 week, 2 days ago
Selected Answer: A
Answer: A According to EC-Council training materials (especially CEH — Certified Ethical Hacker), the most effective evasion technique against signature-based Intrusion Detection Systems (IDS) is: 🔐 Employing IP Fragmentation "IP fragmentation is one of the most effective techniques to evade signature-based IDS, as it breaks the attack payload into multiple packets that may not be reassembled correctly by the IDS."
upvoted 1 times
NikoTomas
1 week, 2 days ago
⚠️ Other Options Explained: B. Implement case variation by altering the case of SQL statements • Most modern IDSs normalize input. 🚫 Limited effectiveness. C. Leverage string concatenation to break identifiable keywords • Turns UNION SELECT into UNI + ON SEL + ECT • Some IDS systems detect common string obfuscation patterns, so this is partially effective, but not stealthy. ⚠️ Moderately useful for application-level filters, but weaker at the network layer. D. Use Hex encoding to represent the SQL query string • Converts payload to something like 0x73656c65637420 (select ) • Many modern IDS/IPS systems decode hex automatically ⚠️ Good for bypassing input filters, less effective at evading advanced IDS.
upvoted 1 times
...
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago