SQL Injection and Database Concepts

The video tutorial by Toby from Alline Security covers SQL injection, a common application attack targeting SQL databases. It demonstrates setting up a vulnerable application, DVWA, on Kali Linux to perform SQL injection attacks. The tutorial explains how to execute these attacks, analyze results, explore database structures, and review web server logs for traces of SQL injection. It concludes with a review of key concepts and comprehensive questions.

What is the primary target of a SQL injection attack?

• Application firewall

• SQL database server

• Network router

• Web server

What is the purpose of sending SQL queries to a web server in a SQL injection attack?

• To crash the web server

• To slow down the network

• To retrieve unauthorized information from the database

• To update the web server software

What does the response 'you have an error in your SQL syntax' indicate?

• The user is not authorized

• The database is not reachable

• The SQL query was accepted but had a syntax error

• The web server is down

What is a common malicious SQL query used to extract all user information?

• 1' OR '1'='1

• SELECT * FROM users

• DROP TABLE users

• INSERT INTO users VALUES ('admin', 'password')

Which user account was not present in the SQL injection results?

• Morgan

• Gordon

• Pablo

• Bob

What does the UNION SQL command do?

• Deletes data from a table

• Combines results from multiple queries

• Updates data in a table

• Creates a new table

What is the purpose of the information_schema in SQL databases?

• To manage database connections

• To log user activities

• To store metadata about the database

• To store user passwords

Which of the following is NOT a column name in the users table of the dvwa database?

• userID

• firstName

• lastName

• name

What is the percent encoding for a single quote in web server logs?

• %2F

• %40

• %20

• %27

What evidence in a website's log is most clearly indicative of a SQL injection attempt?

• Frequent 404 errors

• High CPU usage

• Slow page load times

• Presence of SQL keywords like UNION and SELECT