QUESTION: 77

A Blind SQL injection is a type of SQL Injection attack that asks the database true or false questions and determines the answer based on the application response. This attack is often used when the web application is configured to show generic error messages, but has not mitigated the code that is vulnerable to SQL injection.

It is performed when an error message is not received from application while trying to exploit SQL vulnerabilities. The developer's specific message is displayed instead of an error message. So it is quite difficult to find SQL vulnerability in such cases.

A pen tester is trying to extract the database name by using a blind SQL injection. He tests the database using the below query and finally finds the database name.

http://juggyboy.com/page.aspx?id=1; IF (LEN(DB_NAME())=4) WAITFOR DELAY '00:00:10'-- http://juggyboy.com/page.aspx?id=1; IF (ASCII(lower(substring((DB_NAME()),1,1)))=97) WAITFOR DELAY '00:00:10'--
http://juggyboy.com/page.aspx?id=1; IF (ASCII(lower(substring((DB_NAME()),2,1)))=98) WAITFOR DELAY '00:00:10'--
http://juggyboy.com/page.aspx?id=1; IF (ASCII(lower(substring((DB_NAME()),3,1)))=99) WAITFOR DELAY '00:00:10'--
http://juggyboy.com/page.aspx?id=1; IF (ASCII(lower(substring((DB_NAME()),4,1)))=100) WAITFOR DELAY '00:00:10'--

What is the database name?

WXYZ
PQRS
EFGH
ABCD

Answer(s): D

Reference:

http://www.scribd.com/doc/184891028/CEHv8-Module-14-SQL-Injection-pdf (see module 14, page 2049 to 2051)

Reveal Solution Next Question

QUESTION: 78

Packet filtering firewalls are usually a part of a router. In a packet filtering firewall, each packet is compared to a set of criteria before it is forwarded.
Depending on the packet and the criteria, the firewall can:
i) Drop the packet
ii) Forward it or send a message to the originator

At which level of the OSI model do the packet filtering firewalls work?

Application layer
Physical layer
Transport layer
Network layer

Answer(s): D

Reference:

http://books.google.com.pk/books?id=KPjLAyA7HgoC&pg=PA208&lpg=PA208&dq=At+which+level+of+the+OSI+model+do+the+packet+filtering+firewalls+work&source=bl&ots=zRrbcmY3pj&sig=I3vuS3VA7r-3VF8lC6xq_c_r31M&hl=en&sa=X&ei=wMcfVMetI8HPaNSRgPgD&ved=0CC8Q6AEwAg#v
=onepage&q=At%20which%20level%20of%20the%20OSI%20model%20do%20the%20packet%20filtering%20firewalls%20work&f=false (packet filters)

Reveal Solution Next Question

QUESTION: 79

Identify the data security measure which defines a principle or state that ensures that an action or transaction cannot be denied.

Availability
Integrity
Authorization
Non-Repudiation

Answer(s): D

Reference:

http://en.wikipedia.org/wiki/Information_security (non-repudiation)

Reveal Solution Next Question

QUESTION: 80

Assessing a network from a hacker's point of view to discover the exploits and vulnerabilities that are accessible to the outside world is which sort of vulnerability assessment?

Network Assessments
Application Assessments
Wireless Network Assessments
External Assessment

Answer(s): D

Reference:

http://controlcase.com/managed_compliance_pci_vulnerability_scan.html

Reveal Solution Next Question

Free ECSAV8 Exam Braindumps (page: 21)

QUESTION: 77

Reference:

QUESTION: 78

Reference:

QUESTION: 79

Reference:

QUESTION: 80

Reference:

ECSAV8 Discussions & Posts