English
Menu

Information Security Basics

In a web application, entering a string such as ' OR '1'='1 in the password field of the login screen lets someone log in without knowing the password. What is this attack called?

  1. ASQL injection
  2. BCross-site scripting
  3. CDirectory traversal
Show answer and explanation

Answer: A. SQL injection

SQL injection exploits a web application that builds database commands (SQL statements) by simply concatenating user input as strings. For example, when ' OR '1'='1 is inserted where the condition "the password equals 'input'" is built, the quotation mark closes the string and the always-true condition "or '1' equals '1'" gets added. As a result the condition holds without the password, and the login succeeds. The same method can also be used to steal, alter or delete data. The fundamental countermeasure is a mechanism that never interprets input as part of the command: prepared statements with placeholders.

  • A. Correct. An attack in which input changes the meaning of an SQL statement is SQL injection.
  • B. Cross-site scripting embeds malicious scripts in web pages so that they run in visitors' browsers.
  • C. Directory traversal puts sequences such as ../ into a file name parameter to read files that are not meant to be public.
Practice this topic Back to topic

Related calculators

Password Brute-Force Time CalculatorCompute the number of combinations and the entropy from the character set and length, and estimate brute-force time

Books on Information Security Basics Ad

As an Amazon Associate I earn from qualifying purchases.

More Information Security Basics questions

  1. As a countermeasure against SQL injection, why are prepared statements with placeholders (parameterized queries) considered more fundamental than removing dangerous characters from the input?
  2. A bulletin-board web application had a vulnerability in which scripts contained in text posted by users were executed in other visitors' browsers. Which combination correctly gives the name of this vulnerability and its fundamental countermeasure?
  3. A web application has a vulnerability in which, if a logged-in user opens a trap page prepared by an attacker, the user's browser sends requests to the legitimate site that the user did not intend, such as transferring money or changing settings. Which is an appropriate countermeasure?
  4. A web application reads and displays a file by joining a file name given in a URL parameter to the name of its public folder. If a value containing ../ is given as the file name, configuration files and other files outside the public folder can be read. Which combination correctly gives the name of this attack and a countermeasure?
  5. If a web application keeps using the same session ID before and after login, an attacker may get the user to use a session ID the attacker prepared in advance and then, after the user logs in, impersonate the user with that ID. What is the most appropriate countermeasure against this attack?