312-50 Question 361
Single answer▪ SQL Injection ToolsDuring an authorized web application assessment, you discover that the product page submits a GET request such as https://shop.example.com/item.php?id=42. Manual testing shows the parameter may be injectable, but the application uses a login session and a custom User-Agent header to reach the vulnerable page. You want to safely confirm the vulnerability and identify the back-end DBMS with a widely used SQL injection tool before attempting any data extraction. Which command is the most appropriate?
- A
sqlmap -u "https://shop.example.com/item.php?id=42" --cookie="PHPSESSID=abc123" -A
- B
sqlmap -u "https://shop.example.com/item.php?id=42" --cookie="PHPSESSID=abc123" --user-agent="CorpTestAgent/1.0" --batch --banner
- C
nikto -h "https://shop.example.com/item.php?id=42" --cookie "PHPSESSID=abc123"
- D
sqlmap -u "https://shop.example.com/item.php?id=42" --cookie="PHPSESSID=abc123" --os-shell
Show answer and explanation
Correct answer: B
Explanation
For SQL injection tool usage in a CEH-style practical scenario, sqlmap is the standard choice for confirming injectable parameters, fingerprinting the DBMS, and performing controlled enumeration. In this case, the tester must preserve the authenticated context with --cookie and satisfy the application's request handling requirement with a custom --user-agent. Using --banner is a restrained way to identify the DBMS once injection is confirmed, whereas options like broad enumeration (-A) or aggressive actions such as --os-shell exceed the stated scope and increase risk. This aligns with ethical testing best practices: validate the finding with the minimum necessary impact, maintain proper authorization boundaries, and avoid unnecessary exploitation. References: sqlmap official usage documentation covers authenticated testing via --cookie, header customization such as --user-agent, and DBMS fingerprinting/enumeration options like --banner; OWASP guidance on SQL Injection emphasizes careful validation and least-invasive testing during authorized assessments.
- A. Incorrect.
Incorrect.
sqlmapis the correct tool family for SQL injection testing, and supplying the session cookie is appropriate. However,-Atells sqlmap to enumerate all databases' contents, users, tables, and more depending on context, which is far beyond simply confirming injection and identifying the DBMS. It is noisier and less aligned with the stated goal of safe initial validation. - B. Correct.
Correct. This command uses
sqlmap, includes the authenticated session cookie, sets the required customUser-Agent, and uses--bannerto retrieve the database banner/version information after detecting injection.--batchis also practical in an assessment because it accepts default prompts non-interactively. This is the best fit for confirming the issue and identifying the back-end DBMS with minimal unnecessary enumeration. - C. Incorrect.
Incorrect. Nikto is a web server scanner used to identify common misconfigurations, outdated software, and known files or vulnerabilities. It is not the appropriate tool for exploiting or validating SQL injection in a parameterized request. A candidate might choose this if they confuse general web vulnerability scanning with targeted SQL injection testing.
- D. Incorrect.
Incorrect.
sqlmapwith--os-shellattempts operating system command shell access through the DBMS, which is a much more intrusive post-exploitation step. It is not appropriate for an initial confirmation task when the stated objective is only to verify SQL injection and fingerprint the DBMS. Choosing this reflects a common mistake of escalating too quickly without following least-impact testing practices.