Exam 312-50v12 topic 1 question 182 discussion

Actual exam question from ECCouncil's 312-50v12

Question #: 182
Topic #: 1

During an attempt to perform an SQL injection attack, a certified ethical hacker is focusing on the identification of database engine type by generating an ODBC error. The ethical hacker, after injecting various payloads, finds that the web application returns a standard, generic error message that does not reveal any detailed database information. Which of the following techniques would the hacker consider next to obtain useful information about the underlying database?

A. Utilize a blind injection technique that uses time delays or error signatures to extract information
B. Try to insert a string value where a number is expected in the input field
C. Attempt to compromise the system through OS-level command shell execution
D. Use the UNION operator to combine the result sets of two or more SELECT statements

Show Suggested Answer

Suggested Answer: A 🗳️

by DarioReymag at Feb. 6, 2024, 10:38 p.m.

Comments

Submit Cancel

LordXander

10 months, 2 weeks ago

Selected Answer: A

B - would be filtered out C - well...if you already have shell capabilities, why bother with database errors D - same for B A - seems the most plausible one

upvoted 2 times

...

dobarb

11 months, 1 week ago

A is correct. CEH page 2223-2224

upvoted 1 times

...

insaniunt

1 year ago

Selected Answer: A

A. Utilize a blind injection technique that uses time delays or error signatures to extract information

upvoted 3 times

...