Connection String Injection:
A connection string injection attack can occur when dynamic string concatenation is used to build connection strings that are based on user input. If the string isn’t validated and malicious text or characters are not escaped, an attacker can potentially access sensitive data or other resources on the server. For example, an attacker could mount an attack by supplying a ***semicolon*** and appending another value. The connection string is parsed by using a “last one wins” algorithm, and the hostile input is replaced with a legitimate value.
source from :https://www.geeksforgeeks.org/what-is-connection-string-parameter-pollution/
I agree, A) is correct - injecting parameters with semicolons, which separate commands.
D) is incorrect - multiple parameters with the SAME NAME in HTTP request - it usually does nothing, because another occurence of the same parameter (or HTTP header like "host:", "origin:" etc..) just REWRITES the value of the previous occurence. So in the end, there is just 1 parameter.
There are some attacks like HTTP request smuggling, which exploit inconsistency in processing of HTTP headers between front-end server (loadbalancer / proxy) and back-end server, however they aren't based on repeating of the same HTTP header but playing with order of two headers: Content-Length and Transfer-Encoding + optionally some fuzzing to confuse server. This is just for info.
Connection Stream Parameter Pollution (CSPP) je vrsta napada, ki se izvaja na spletnih strežnikih in aplikacijah, ki uporabljajo protokol HTTP. Gre za vrsto napada na ravni aplikacije, ki izkorišča šibkosti v načinu, kako aplikacije obdelujejo parametre zahteve HTTP.
Connection String Parameter Pollution (CSPP) attacks consist of injecting connection string parameters into other existing parameters. This vulnerability is similar to vulnerabilities, and perhaps more well known, within HTTP environments where parameter pollution can also occur. However, it also can apply in other places such as database connection strings. If an application does not properly sanitize the user input, a malicious user may compromise the logic of the application to perform attacks from stealing credentials, to retrieving the entire database. By submitting additional parameters to an application, and if these parameters have the same name as an existing parameter, the database connection may react in one of the following ways:
upvoted 1 times
...
This section is not available anymore. Please use the main Exam Page.312-50 Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
max_max_max
1 year agoNikoTomas
8 months agoNovmejst
1 year, 6 months agodorinh
2 years, 11 months ago