Web Security: Common Vulnerabilities And Their Mitigation - Anatomy of a SQLi attack - getting valid credentials for the

What is the primary goal when querying a database for forgotten passwords?

• To retrieve the password directly

• To delete the user account

• To find out if an email exists in the database

• To change the password

What can an attacker potentially do if they have read-write permissions on a database?

• Access the server logs

• View all user passwords

• Delete entire tables

• Change the database schema

How does an attacker use a mined email address to gain access to a site?

• By sharing it with other attackers

• By updating it to their own email address

• By encrypting the email

• By deleting the email from the database

What does the attacker achieve by updating the email address in the database?

• They receive the password for the account

• They encrypt the account data

• They delete the account

• They gain administrative access

What is a key characteristic of a blind SQL injection attack?

• The attacker has direct access to the database

• The attacker uses server responses to make guesses

• The attacker can see the results of their queries

• The attacker can modify server configurations

What is the first step in a blind SQL injection attack?

• Encrypting the database

• Changing the server settings

• Directly accessing the database

• Identifying when the server returns successful responses

Why is patience important in executing a blind SQL injection attack?

• Because the attacker needs to wait for user input

• Because the attacker needs to wait for server downtime

• Because the attacker needs to decrypt data

• Because crafting SQL statements and making guesses takes time