Exam PT0-002 topic 1 question 231 discussion

Blind SQL Injection: Certified Ethical Hacker v8 module14 https://studylib.net/doc/25231781/cehv8---module-14---sql-injection

SQL Injection so A

A is the answer WAITFOR can be used in a type of SQL injection attack known as time delay SQL injection or blind SQL injection34. This attack works on the basis that true or false queries can be answered by the amount of time a request takes to complete. For example, an attacker can inject a WAITFOR command with a delay argument into an input field of a web application that uses SQL Server as its database. If the query returns true, then theweb application will pause for the specified period of time before responding; if the query returns false, then the web application will respond immediately. By observing the response time, the attacker can infer information about the database structure and data1. Based on this information, one possible answer to your question is A. SQL injection, because it is an attack that exploits a vulnerability in a web application that allows an attacker to execute arbitrary SQL commands on the database server.

I think A is the answe SQL injection

C. Remote command injection is the attack that is being attempted. The "WAITFOR" command allows a remote attacker to execute arbitrary commands on the target system, which can be used to gain access to sensitive data or to further exploit the system. This type of attack is commonly seen in web-application log files and should be guarded against with proper input validation. SQL injection is not the attack that is being attempted. SQL injection is a type of attack which involves supplying malicious SQL commands to a web application in order to gain access to sensitive data or to further exploit the system. The "WAITFOR" command does not involve SQL commands and instead is used to execute arbitrary commands on the target system, making it more likely to be a remote command injection attack.

The "WAITFOR" command is used to execute arbitrary commands on a target system. This type of attack is commonly seen in web-application log files and can be used to gain access to sensitive data or to further exploit the system. It is important to practice proper input validation and strong security measures to guard against this type of attack.