sql

SQL

SQL injection (SQLi) attacks attempt to inject SQL syntax into web requests, which may bypass authentication and allow attackers to access and/or modify data attached to a web application. Which of the following SQLi types leverages a database server’s ability to make DNS requests to pass data to an attacker?

Leave a Comment / CEHv11 / By

SQL injection (SQLi) attacks attempt to inject SQL syntax into web requests, which may bypass authentication and allow attackers to access and/or modify data attached to a web application. Which of the following SQLi types leverages a database server’s ability to make DNS requests to pass data to an attacker? Option 1 : Union-based SQLi Option 2 : In-band SQLi Option 3 : Out-of-band SQLi Option 4 : Time-based blind SQLi 1. Union-based SQLi Union …

SQL injection (SQLi) attacks attempt to inject SQL syntax into web requests, which may bypass authentication and allow attackers to access and/or modify data attached to a web application. Which of the following SQLi types leverages a database server’s ability to make DNS requests to pass data to an attacker? Read More »

SQL

Ethical hacker Jane Smith is attempting to perform an SQL injection attack. She wants to test the response time of a true or false response and wants to use a second command to determine whether the database will return true or false results for user IDs. Which two SQL injection types would give her the results she is looking for?

Leave a Comment / CEHv11 / By

Ethical hacker Jane Smith is attempting to perform an SQL injection attack. She wants to  test the response time of a true or false response and wants to use a second command to determine whether the database will return true or false results for user IDs. Which two SQL injection types would give her the results she is looking for? Option 1 : Time-based and boolean-based Option 2: Out of band and boolean-based Option 3 …

Ethical hacker Jane Smith is attempting to perform an SQL injection attack. She wants to test the response time of a true or false response and wants to use a second command to determine whether the database will return true or false results for user IDs. Which two SQL injection types would give her the results she is looking for? Read More »

SQL injection

Daniel is a professional hacker who is attempting to perform an SQL injection attack on a target website, www.moviescope.com. During this process, he encountered an IDS that detects SQL injection attempts based on predefined signatures. To evade any comparison statement, he attempted placing characters such as ‘” or ‘1’=’1″ in any basic injection statement such “or 1=1.” Identify the evasion technique used by Daniel in the above scenario.

Leave a Comment / CEHv11 / By

Daniel is a professional hacker who is attempting to perform an SQL injection attack on a target website, www.moviescope.com. During this process, he encountered an IDS that detects SQL injection attempts based on predefined signatures. To evade any comparison statement, he attempted placing characters such as ‘” or ‘1’=’1″ in any basic injection statement such “or 1=1.” Identify the evasion technique used by Daniel in the above scenario. Option 1 : Variation Option 2 : …

Daniel is a professional hacker who is attempting to perform an SQL injection attack on a target website, www.moviescope.com. During this process, he encountered an IDS that detects SQL injection attempts based on predefined signatures. To evade any comparison statement, he attempted placing characters such as ‘” or ‘1’=’1″ in any basic injection statement such “or 1=1.” Identify the evasion technique used by Daniel in the above scenario. Read More »

application

While testing a web application in development, you notice that the web server does not properly ignore the “dot dot slash” (../) character string and instead returns the file listing of a folder structure of the server. What kind of attack is possible in this scenario?

Leave a Comment / CEHv11 / By

While testing a web application in development, you notice that the web server does not properly ignore the “dot dot slash” (../) character string and instead returns the file listing of a folder structure of the server. What kind of attack is possible in this scenario? Option 1 : Denial of service Option 2 : Cross-site scripting Option 3 : SQL injection Option 4 : Directory traversal   1. Denial of service The Denial of …

While testing a web application in development, you notice that the web server does not properly ignore the “dot dot slash” (../) character string and instead returns the file listing of a folder structure of the server. What kind of attack is possible in this scenario? Read More »

John is investing web-application firewall logs and observers that someone is attempting to inject the following : char buff[10]; buff[10] = ‘a’; What type of attack is this ?

Leave a Comment / CEHv11 / By

John is investing web-application firewall logs and observers that someone is attempting to inject the following : char buff[10]; buff[10] = ‘a’; What type of attack is this ? Option 1 : Buffer overflow Option 2 : CSRF Option 3 : SQL injection Option 4 : XSS 1. Buffer overflow Buffer overflow this attack is an anomaly that happens when software writing data to a buffer overflows the buffer’s capacity, leading to adjacent memory locations …

John is investing web-application firewall logs and observers that someone is attempting to inject the following : char buff[10]; buff[10] = ‘a’; What type of attack is this ? Read More »

Determine-the-Database-Evidence-Repositories-and-collect-the-evidence-files

Determine the Database Evidence Repositories & Collect the Evidence files

Leave a Comment / CHFI / By

Determine the Database Evidence Repositories & collect the evidence files in this Sources that provide the valuable information are at times overlooked by the investigators. For instance, in intellectual property cases, databases containing finance related data are the prime targets for attackers to damage databases. In such case, source code repositories, knowledge management systems, and document management systems may provide better insights to the investigator to a suspected breach. Thus, investigators will be able to …

Determine the Database Evidence Repositories & Collect the Evidence files Read More »

Perform-MSSQL-Forensics

Perform MSSQL Forensics

Leave a Comment / CHFI, Knowledge Base / By

Perform MSSQL Forensics in this SQL server is a Relational Database Management System and is being widely adopted by various organizations to store data associated with the applications. This includes sensitive data related to the web application and users’ accounts in the web application. MSSQL forensics take action when a security incident has occurred and detection and analysis of the malicious activities performed by criminals over the SQL database file are required. A forensic investigator …

Perform MSSQL Forensics Read More »

Investigate-various-Attack-on-Web-Application

Investigate various Attack on Web Application

Leave a Comment / CHFI / By

Investigate various Attack on Web Application in this article explain different types of web application attack which is investigate through forensic investigator . 1. Investigating Cross-Site Scripting (XSS) Attack In XSS attack or Cross Site Scripting attack, the attacker exploits the vulnerability in the web by injecting malicious script, mostly Javascript, HTML OF CSS markup in the web pages that is displayed in the user browser. This takes place when the user clicks on the …

Investigate various Attack on Web Application Read More »

Sample DHCP Audit Log File

Leave a Comment / CHFI, Knowledge Base / By

Sample DHCP Audit Log File in this DHCP server during a network allocates IP address to a computer during its begin. Therefore, the DHCP server logs contain information regarding the systems that were assigned specific IP addresses by the server, at any given instance. Investigators can examine these logs during forensic examinations. Now DHCP administrators can easily access this data using the built-in logging mechanisms. The DHCP activity log are often read during a text-based …

Sample DHCP Audit Log File Read More »