WAPT 2 - Up to API

Which of the following SQL injection types uses the same communication channel to retrieve data?

• Blind SQL Injection

• In-band SQL Injection

• Out-of-Band SQL Injection

• Error-Based SQL Injection

Which payload will exploit an In-band SQL injection in a login form?

• ' OR '1'='1; --

• alert(1)

• ' AND 1=2; --

• ../etc/passwd

You intercept the following query: SELECT * FROM users WHERE username = '$user' AND password = '$pass'; What payload can you use to bypass authentication using In-band SQL injection?

• ' OR '1'='1; --

• '; DROP TABLE users;

• ../etc/passwd

• alert('Hack')

Which technique can be used to test for Blind SQL injection?

• Boolean-based testing

• Error-based testing

• Time-based testing

• Code injection

If the payload 1 AND 1=1 returns a result while 1 AND 1=2 does not, what does it indicate?

• The application is vulnerable to Time-based SQL injection

• The application is vulnerable to Boolean-based Blind SQL injection

• The application is secure

• None of the above

You send the payload: ' AND SLEEP(5); -- The response takes 5 seconds to load. What does this confirm?

• Boolean-based Blind SQL injection

• Error-based SQL injection

• Time-based Blind SQL injection

• Reflected XSS

What type of Blind SQL injection is being tested when no error is returned, but delays occur?

• Boolean-based

• Time-based

• In-band

• Error-based

Which payload is used for Time-based Blind SQL injection?

• ' OR 1=1; --

• ' OR SLEEP(5); --

• UNION SELECT NULL;

• ' AND 1=2; --

Test a login form for Time-based Blind SQL injection. Which payload should you use?

• ' AND IF(1=1, SLEEP(5), 0); --

• ' AND IF(1=0, SLEEPP(5), 0); --

• ../etc/passwd

• ' UNION SELECT username, password FROM users; --

What does SQL Injection to RCE rely on?

• Executing operating system commands via database queries

• Injecting scripts into the application

• Bypassing authentication

• Leveraging XSS