13C: Plan Injection Attacks

Question 1

An attack that injects a database query into the input data directed at a server by accessing the client side of the application.

Answer 1

SQLi attack

Question 2

The process of injecting SQL queries when the web application’s response does not contain the result of the query.

Answer 2

blind sqli

Question 3

The process of injecting SQL queries with values that are always true (‘1=1’) and false (‘1=2’).

Answer 3

boolean based sqli

Question 4

The process of injecting SQL queries with time delays

Answer 4

time based sqli

Question 5

CompTIA definition: An application attack that allows access to commands, files, and directories that may or may not be connected to the web document root directory. (really with this type of exploit, you are trying to access upstream directories from where your current access lies by using commands such as ..)

Answer 5

directory traversal

Question 6

A character with a value of zero that is used in most programming languages to indicate the termination of a string.

Answer 6

null byte

Question 7

Exploit technique that runs malicious code with the ID of a legitimate process.

Answer 7

code injection

Question 8

This is a type of web application vulnerability where a threat actor is able to execute arbitrary shell commands on a host via a vulnerable web application.

Answer 8

command injection

Question 9

Faults in the information transmitted, stored, or otherwise managed by IoT devices.

Answer 9

IoT data corruption

Question 10

Network protocol used to access network directory databases, which store information about authorized users and their privileges, as well as other organizational information.

Answer 10

lightweight directory access protocol (LDAP)

Question 11

A malicious script hosted on the attacker’s site or coded in a link injected onto a trusted site designed to compromise clients browsing the trusted site, circumventing the browser’s security model of trusted zones.

Answer 11

cross site scripting (XSS)

Question 12

When an attacker injects malicious code or links into a website’s forums, databases, or other data.

Answer 12

persistent attack

Question 13

A malicious request to a legitimate server is created and sent as a link to the victim, so that a server-side flaw causes the malicious component to run on the target’s browser.

Answer 13

reflected attack

Question 14

When attackers send malicious scripts to a web app’s client-side implementation of JavaScript to execute their attack solely on the client.

Answer 14

Document Object Model (DOM)-based attack