Exam 312-50v13 topic 1 question 218 discussion

Actual exam question from ECCouncil's 312-50v13

Question #: 218
Topic #: 1

An ethical hacker is testing the security of a website's database system against SQL Injection attacks. They discover that the IDS has a strong signature detection mechanism to detect typical SQL injection patterns. Which evasion technique can be most effectively used to bypass the IDS signature detection while performing a SQL Injection attack?

A. Employ IP fragmentation to obscure the attack payload
B. Implement case variation by altering the case of SQL statements
C. Leverage string concatenation to break identifiable keywords
D. Use Hex encoding to represent the SQL query string

Show Suggested Answer

Suggested Answer: D 🗳️

by NikoTomas at March 25, 2025, 9:03 p.m.

Comments

Submit Cancel

KnightHeart

1 month, 2 weeks ago

Selected Answer: D

D: Highly effective for bypassing static keyword-based signatures, as the IDS sees encoded data instead of plaintext SQL keywords.

upvoted 1 times

...

[Removed]

2 months, 2 weeks ago

Selected Answer: D

D is correct

upvoted 3 times

...

NikoTomas

3 months, 1 week ago

Selected Answer: A

Answer: A According to EC-Council training materials (especially CEH — Certified Ethical Hacker), the most effective evasion technique against signature-based Intrusion Detection Systems (IDS) is: 🔐 Employing IP Fragmentation "IP fragmentation is one of the most effective techniques to evade signature-based IDS, as it breaks the attack payload into multiple packets that may not be reassembled correctly by the IDS."

upvoted 1 times

NikoTomas

3 months, 1 week ago

⚠️ Other Options Explained: B. Implement case variation by altering the case of SQL statements • Most modern IDSs normalize input. 🚫 Limited effectiveness. C. Leverage string concatenation to break identifiable keywords • Turns UNION SELECT into UNI + ON SEL + ECT • Some IDS systems detect common string obfuscation patterns, so this is partially effective, but not stealthy. ⚠️ Moderately useful for application-level filters, but weaker at the network layer. D. Use Hex encoding to represent the SQL query string • Converts payload to something like 0x73656c65637420 (select ) • Many modern IDS/IPS systems decode hex automatically ⚠️ Good for bypassing input filters, less effective at evading advanced IDS.

upvoted 1 times

...