SQL Injection Flashcards

SQL Injection Flashcards

What does SQL injection exploit?

Untrusted input incorporated into a database SQL statement.

What does SQL stand for?

Structured Query Language.

What system does SQL injection primarily target?

The database supporting the application.

Does the database have to be on the web server for SQL injection?

No. It can run on a separate server.

What can successful SQL injection allow?

Unauthorized data retrieval, changes, or deletion.

Which part of the sample SQL query contains user input?

The owner value in its WHERE clause.

What does SELECT do?

Retrieves data from a table.

What does UPDATE do?

Changes existing database records.

What does DELETE do?

Removes database rows.

What does FROM specify in a SELECT query?

The source table.

What does WHERE specify?

Conditions that restrict which rows are affected.

What does SET specify in an UPDATE query?

The columns and values to change.

What are the three general parts of a SQL statement in the book?

Verb, source, and refinement.

What does the verb in a SQL statement define?

The action to perform, such as SELECT, UPDATE, or DELETE.

What does the source part of a SQL statement identify?

The table or tables involved.

What is SQL refinement?

An optional condition limiting which data is affected.

What does SELECT * FROM dropbox retrieve?

All columns in the dropbox table.

Does SQL require keywords to be uppercase?

No. Uppercase is used for readability.

How do attackers initially test potential SQL injection inputs?

Enter malformed or special-character input and observe responses.

What is a common SQL injection test character?

A single quote (').

Why might a single quote reveal a SQL injection issue?

It may break SQL string syntax and produce a database error.

What does OR 'a'='a' demonstrate in a vulnerable query?

An always-true condition that can broaden returned rows.

What can an always-true SQL condition cause?

A query can return rows beyond the intended user filter.

What HTTP parameter is tested in the employee directory example?

search.

What input causes an error in the employee directory example?

Taylor followed by a single quote.

What database product is revealed by the error message?

MariaDB.

Why are detailed database errors valuable to attackers?

They can reveal SQL syntax and database product details.

What is Sqlmap?

A Python-based SQL injection detection and exploitation tool.

What does Sqlmap -u specify?

The target URL to test.

What URL parameter is flagged as vulnerable in the book?

The GET parameter search.

What does boolean-based blind SQL injection use?

True-versus-false response differences.

What is error-based SQL injection?

Using database error responses to infer information.

What does Sqlmap report after finding an injection point?

The parameter, injection type, and sample payload.

Name two commercial SQL injection testing tools in the book.

Burp Suite Professional and Acunetix.

What is the first important rule for Sqlmap URLs?

Start with a valid URL that does not produce an error.

Why must the starting URL be valid when using Sqlmap?

Sqlmap uses it as the normal baseline for testing.

What is the second important rule for Sqlmap URLs?

Surround the URL with quotes.

Why quote a URL containing & in a shell?

Otherwise the shell may interpret & instead of passing the full URL.

What does Sqlmap --dbs enumerate?

Available database names.

What does Sqlmap -D specify?

The database name to examine.

What does Sqlmap --tables display?

Tables in the selected database.

Which database in the example contains comments and users tables?

web_app.

What does Sqlmap -T specify?

The table name to examine.

What does Sqlmap --columns enumerate?

Column names and types in a selected table.

What does Sqlmap --dump do?

Retrieves and displays records from the selected table.

What does Sqlmap --sql-shell start?

An interactive SQL query interface for the target database.

Which options select a named database and table?

-D for database and -T for table.

What must be selected before enumerating columns?

The target database and table.

Does moving a SQL database to the cloud eliminate SQL injection?

No. Cloud databases can still be vulnerable.

What does ORM stand for?

Object Relational Mapping.

How can ORM frameworks help reduce SQL injection risk?

They abstract SQL query construction from application code.

Why can lightweight or serverless code reintroduce SQL injection?

Developers may build SQL strings directly rather than use safe abstractions.

Name two ORM frameworks mentioned in the book.

Hibernate and SQLAlchemy.

Why can SQL injection testing damage a system?

An injected statement may modify or delete production data.

What must be confirmed before a potentially destructive SQL injection test?

A tested and recoverable database backup.

What is dangerous about omitting WHERE from UPDATE?

The UPDATE may change every row in the table.

What does -- do in the SQL injection example?

Begins a comment that can suppress the remaining SQL text.

What makes a backup useful during SQL injection testing?

The team has verified it can restore the database.

What is the preferred coding defense against SQL injection?

Parameterized queries or prepared statements.

Why do parameterized queries stop SQL injection?

They keep input values separate from SQL statement structure.

What should developers avoid when constructing SQL queries?

String concatenation with untrusted input.

What is a WAF useful for in SQL injection defense?

Monitoring and partially blocking attack attempts.

Can a WAF alone reliably prevent SQL injection?

No. Secure application queries are still required.

What database privilege principle limits SQL injection impact?

Least privilege for the application database account.

What should database security logging watch for?

Failed SQL statements and SQL syntax errors.

Which two database platforms does the course identify as lacking some error logging?

MySQL and MariaDB.

Is filtering dangerous characters the preferred SQL injection defense?

No. Parameterized queries are preferred.

What does ? represent in the Java prepared-statement example?

A parameter placeholder bound to a value.

Which Java method prepares a parameterized SQL query?

prepareStatement().

Which Java method supplies the username parameter in the sample?

setString(1, customer).

What is the central lesson of the SQL injection visual summary?

Untrusted input must not control SQL query syntax.

What is the main cloud SQL security takeaway?

Cloud hosting does not replace safe query design.