Central Frost Bank was a medium-sized, regional financial institution in New York. The bank recently deployed a new Internet-accessible Web application. Using this application, Central Frost's customers could access their account balances, transfer money between accounts, pay bills and conduct online financial business through a Web browser. John Stevens was in charge of information security at Central Frost Bank. After one month in production, the Internet banking application was the subject of several customer complaints. Mysteriously, the account balances ofmany of Central Frost's customers had been changed! However, moneyhadn't been removed from the bank. Instead, money was transferred between accounts. Given this attack profile, John Stevens reviewed the Web application's logs and found the following entries:Attempted login of unknown user: johnmAttempted login of unknown user: susaRAttempted login of unknown user: sencatAttempted login of unknown user: pete'';Attempted login of unknown user: ' or 1=1--Attempted login of unknown user: '; drop table logins--Login of user jason, sessionID= 0x75627578626F6F6BLogin of user daniel, sessionID= 0x98627579539E13BELogin of user rebecca, sessionID= 0x9062757944CCB811Login of user mike, sessionID= 0x9062757935FB5C64Transfer Funds user jasonPay Bill user mikeLogout of user mikeWhat type of attack did the Hacker attempt?
Answer(s): C
The 1=1 or drop table logins are attempts at SQL injection.
A particular database threat utilizes a SQL injection technique to penetrate a target system. How would an attacker use this technique to compromise a database?
Answer(s): A
Using the poorly designed input validation to alter or steal data from a database is a SQL injection attack.
Jimmy, an attacker, knows that he can take advantage of poorly designed input validation routines to create or alter SQL commands to gain access to private data or execute commands in the database. What technique does Jimmy use to compromise a database?
Answer(s): B
SQL injection is a security vulnerability that occurs in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed. It is in fact an instance of a more general class of vulnerabilities that can occur whenever one programming or scripting language is embedded inside another.
Identify SQL injection attack from the HTTP requests shown below:
The correct answer contains the code to alter the usertable in order to change the password for user smith to hAx0r
What is the problem with this ASP script (login.asp)?<%Set objConn = CreateObject("ADODB.Connection")objConn.Open Application("WebUsersConnection")sSQL="SELECT * FROM Users where Username=? & Request("user") & _"?and Password=? & Request("pwd") & "?Set RS = objConn.Execute(sSQL)If RS.EOF thenResponse.Redirect("login.asp?msg=Invalid Login")ElseSession.Authorized = TrueSet RS = nothingSet objConn = nothing Response.Redirect("mainpage.asp")End If%>
Post your Comments and Discuss EC-Council 312-50 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-50 content, but please register or login to continue.