312-50 Question 360
Single answer▪ SQL Injection ToolsDuring an authorized web application assessment, you identify a GET parameter that appears vulnerable to SQL injection: https://target.example/products.php?id=12. The client has asked you to confirm the issue, enumerate the backend database type, and retrieve the current database name while minimizing unnecessary requests and avoiding aggressive techniques that could disrupt the application. Which tool and approach is the most appropriate?
- A
Use sqlmap against the parameter with targeted detection and enumeration options such as
-ufor the URL,-p idto test only the suspected parameter, and enumeration switches like--bannerand--current-db, while keeping the scan conservative - B
Use Hydra to brute-force the web application's login form first, because valid credentials are required before any SQL injection testing can identify the database type
- C
Use John the Ripper to crack password hashes from the web server, then use the recovered credentials to manually inspect the database name from the administration portal
- D
Use Nikto to exploit the SQL injection automatically and dump the current database name, since Nikto is designed for database enumeration on vulnerable parameters
Show answer and explanation
Correct answer: A
Explanation
The best answer is the sqlmap-based approach because the scenario explicitly involves confirming a suspected SQL injection vulnerability, identifying the backend database type, and retrieving the current database name with minimal disruption. sqlmap is a widely used tool for automated SQL injection detection and exploitation. Best practice in an authorized assessment is to scope testing carefully: point the tool at the exact URL, restrict testing to the specific parameter with -p, and use only the enumeration features needed for validation, such as --banner and --current-db, instead of aggressive dumping or high-risk techniques. This matches the principle of least impact during ethical hacking engagements. Relevant references include the official sqlmap usage documentation, which covers DBMS fingerprinting and enumeration features, and standard penetration testing methodology guidance emphasizing targeted, minimally invasive validation of findings.
- A. Correct.
Correct. sqlmap is the appropriate SQL injection testing and exploitation tool for this scenario. It is specifically built to detect and exploit SQL injection flaws, fingerprint the backend DBMS, and enumerate information such as the current database name. Using
-uspecifies the target URL,-p idlimits testing to the known suspect parameter, and enumeration options such as--bannerand--current-dbalign directly with the client's goals. Keeping the scan conservative is important in professional assessments to reduce unnecessary traffic and avoid disruptive behavior. In practice, testers often also avoid risky options and tune level/risk appropriately. - B. Incorrect.
Incorrect. Hydra is a password-cracking and online authentication brute-force tool, not a SQL injection tool. A common misconception is that gaining credentials is a necessary first step for all forms of web application testing. In this case, the suspected issue is in a public GET parameter, so SQL injection can be tested directly without brute-forcing a login. Using Hydra here would also create unnecessary noise and could violate the client's request to minimize impact.
- C. Incorrect.
Incorrect. John the Ripper is an offline password-cracking tool used for recovering plaintext credentials from password hashes. It does not test web parameters for SQL injection, fingerprint a DBMS, or enumerate the current database from a vulnerable URL parameter. Someone might choose this option if they confuse general credential attacks with application-layer injection testing, but it does not address the stated objective.
- D. Incorrect.
Incorrect. Nikto is primarily a web server and web application scanner used to identify dangerous files, outdated server software, and common misconfigurations. It is not the standard tool for exploiting SQL injection and retrieving details like the current database name from a specific injectable parameter. Candidates may pick Nikto because it is a common web assessment tool, but it does not provide the focused SQL injection exploitation workflow that sqlmap does.