lab 15 Flashcards
What user account name is not present in this SQLi result?
admin
Hack
Morgan
Bob
Pablo
Gordon
Morgan
Which of the following are column names from the users table of the dvwa database? (Select seven (7) column names)
user_id
avatar
failed_login
comment
first_name
last_login
last_name
name
password
USER
user_id
avatar
failed_login
first_name
last_login
last_name
password
What is the HTTP referrer for this log record related to your first submission to the SQLi page of just the number ‘1’?
“GET /vulnerabilities/sqli/”
“GET /vulnerabilities/sqli/?id=7&Submit=Sumbit# HTTP/1.1”
“GET /vulnerabilities/xss_r/ HTTP/1.1”
“GET /vulnerabilities/sqli/?id=1&Submit=Sumbit# HTTP/1.1”
“GET /vulnerabilities/sqli/”
What is the percent-encoding for a single quotation mark?
%3e
%3a
%27
%21
%27
What could be found in a website’s access log as a representation of a space in an HTTP request? (Select 2)
+ (a plus sign)
%3c
%20
%22
+ (a plus sign)
%20
Why is the octothorpe after the ‘NULL’ parameter used in this submitted SQLi statement?
end-of-line comment
carriage return and line feed
to append the command to the existing script statement
retrieve certain records from one or more tables.
end-of-line comment
In SQLi, what is the most important character?
octothorp
equals
backslash
asterisks
single quote
single quote
What is the SQL expression used to combine instructions or operations?
INSERT
UNION
SELECT
FROM
UNION
Which of the following SQLi statements is used to return a result which includes the DBMS details?
’ UNION SELECT @@version, NULL#
’ UNION SELECT table_name, column_name FROM information_schema.columns#
’ UNION SELECT table_schema, table_name FROM information_schema.tables#
’ UNION SELECT user, password FROM users#
’ UNION SELECT @@version, NULL#
What evidence in a website’s log is most clearly IoC observables related to SQLi?
percent-encoding
an HTTP referrer
ORDER BY, UNION, SELECT, UPDATE, INSERT, DELETE, or DROP
the HTTP response code of 200
ORDER BY, UNION, SELECT, UPDATE, INSERT, DELETE, or DROP
What is the first table name discovered from the DVWA database?
users
What is the second table name discovered from the DVWA database?
guestbook
