312-50 Question 329
Single answer▪ Perform Injection/Input Validation AttacksDuring an authorized web application assessment, you test a product search feature that sends a GET request such as /search?q=laptop. The response reflects search results from a backend SQL database. When you submit q=' OR '1'='1, the application returns all products instead of only matching items. The application does not display database errors, and the engagement rules require you to confirm the issue with the least disruptive technique possible. Which action is the BEST next step to validate the vulnerability while minimizing impact?
- A
Use a boolean-based test such as q=' AND '1'='2 and compare the response with q=' AND '1'='1 to confirm controllable query logic
- B
Attempt a UNION SELECT payload to enumerate table names and verify the database type immediately
- C
Launch an automated SQL injection tool with dumping enabled to collect sample records as proof
- D
Try stacked queries to create a temporary administrative user and prove exploitability
Show answer and explanation
Correct answer: A
Explanation
This scenario describes classic SQL injection behavior caused by unsanitized input being incorporated into a backend query. Because the payload ' OR '1'='1 changes the result set to return all products, the best professional next step is a boolean-based confirmation using true and false conditions. This method helps demonstrate that the application is evaluating attacker-controlled SQL logic without requiring error messages, data extraction, or state-changing actions. From a best-practice perspective, ethical hackers should follow the principle of least impact and stay within the rules of engagement. OWASP testing guidance and the OWASP SQL Injection Prevention Cheat Sheet emphasize safe validation, parameterized queries, and proper input handling as mitigations. In practice, a confirmed difference between responses for conditions such as ' AND '1'='1 versus ' AND '1'='2 is strong evidence of SQL injection while avoiding unnecessary enumeration or data access.
- A. Correct.
Correct. A boolean-based follow-up is a low-impact way to confirm SQL injection by showing that the application's behavior changes predictably based on true versus false conditions injected into the query. This approach aligns with the requirement to validate the issue using the least disruptive technique possible. Comparing responses from true and false conditions is a standard, controlled confirmation method when error messages are suppressed.
- B. Incorrect.
Incorrect. A UNION-based payload may be useful later for controlled enumeration, but it is more intrusive than necessary for initial validation. It also depends on column count, data type alignment, and output reflection. Jumping straight to enumeration does not satisfy the requirement to minimize impact.
- C. Incorrect.
Incorrect. Automatically dumping records is unnecessarily aggressive for initial confirmation and may violate rules of engagement or data-handling constraints. In a professional assessment, testers should first use minimal, non-destructive techniques to validate the finding before considering deeper exploitation, and only if explicitly authorized.
- D. Incorrect.
Incorrect. Using stacked queries to modify data or create users is highly invasive and unnecessary to confirm the vulnerability. This could disrupt operations or cross the boundary from validation into exploitation. It is not an appropriate next step when the goal is low-impact verification.