SQL Injection and Database Concepts

What is the primary target of a SQL injection attack?

• Application firewall

• SQL database server

• Network router

• Web server

What is the purpose of sending SQL queries to a web server in a SQL injection attack?

• To crash the web server

• To slow down the network

• To retrieve unauthorized information from the database

• To update the web server software

What does the response 'you have an error in your SQL syntax' indicate?

• The user is not authorized

• The database is not reachable

• The SQL query was accepted but had a syntax error

• The web server is down

What is a common malicious SQL query used to extract all user information?

• 1' OR '1'='1

• SELECT * FROM users

• DROP TABLE users

• INSERT INTO users VALUES ('admin', 'password')

Which user account was not present in the SQL injection results?

• Morgan

• Gordon

• Pablo

• Bob

What does the UNION SQL command do?

• Deletes data from a table

• Combines results from multiple queries

• Updates data in a table

• Creates a new table

What is the purpose of the information_schema in SQL databases?

• To manage database connections

• To log user activities

• To store metadata about the database

• To store user passwords

Which of the following is NOT a column name in the users table of the dvwa database?

• userID

• firstName

• lastName

• name

What is the percent encoding for a single quote in web server logs?

• %2F

• %40

• %20

• %27

What evidence in a website's log is most clearly indicative of a SQL injection attempt?

• Frequent 404 errors

• High CPU usage

• Slow page load times

• Presence of SQL keywords like UNION and SELECT