312-50 Question 338
Single answer▪ Attack Database ConnectivityDuring an authorized assessment, you discover a web application that connects to a Microsoft SQL Server back end through an ODBC DSN configured on the Windows web server. The application masks database errors, but you confirm SQL injection in a login form. The client wants proof of risk specifically related to database connectivity rather than only data extraction. Which action would BEST demonstrate an attack against the database connectivity layer while staying within the scope of a controlled CEH-style test?
- A
Use the SQL injection point to enumerate the DSN connection details and attempt to leverage the trusted database connection to access the SQL Server with the web application's privileges
- B
Launch a SYN flood against TCP 1433 to prove that the SQL Server listener can be disrupted through network-layer denial of service
- C
Dump all user password hashes from the SQL Server immediately because any SQL injection proves full database compromise
- D
Exploit the Windows server with a local privilege escalation first, then read the registry to obtain every ODBC configuration entry
Show answer and explanation
Correct answer: A
Explanation
The best answer is to demonstrate abuse of the application's established database connection path, because the scenario specifically asks for proof related to database connectivity. In CEH-style practice, this means showing how a weakness such as SQL injection can be used not only to query data but also to leverage the trust and privileges inherent in the application's database connection. With Microsoft SQL Server and ODBC, relevant indicators include the database context, login context, role membership, and whether the application uses SQL authentication or integrated security. This is more precise than generic data dumping or unrelated host/network attacks. Microsoft documentation on ODBC DSNs and SQL Server connection security, along with OWASP guidance on SQL Injection testing, supports focusing on how application connection configuration and privileges affect exploit impact. Best practice during an authorized test is to validate least privilege, avoid unnecessary service disruption, and demonstrate only the minimum proof needed to show risk.
- A. Correct.
Correct. This directly targets the database connectivity path used by the application. In a real assessment, demonstrating that the application's ODBC/DSN-based connection can be abused through SQL injection to enumerate connection context, database name, service account context, or trusted connection behavior is a focused way to show risk in the connectivity layer. It is more aligned with 'attack database connectivity' than simply extracting table data. In Microsoft environments, DSN and connection settings may reveal whether the application uses SQL authentication or Windows integrated authentication, which affects the impact of compromise.
- B. Incorrect.
Incorrect. A SYN flood targets network availability, not database connectivity abuse through the application-to-database trust relationship. While TCP 1433 is commonly used by SQL Server, this option tests denial-of-service at the network layer rather than exploitation of database connectivity mechanisms. It also may exceed scope in many assessments because availability attacks are often prohibited unless explicitly authorized.
- C. Incorrect.
Incorrect. SQL injection does not automatically mean unrestricted access to all password hashes or full compromise. Actual impact depends on the application's database privileges, DBMS configuration, available functions, and defensive controls. This option reflects a common misconception that any injection instantly grants complete database ownership.
- D. Incorrect.
Incorrect. Local privilege escalation on the Windows host is a different attack path. Although ODBC DSN information can be stored in the registry, exploiting the server first goes beyond the stated goal of demonstrating risk in the database connectivity layer through the discovered web application weakness. It is also less controlled and may violate scope if host exploitation was not authorized.