312-50 Question 362
Single answer▪ SQL Injection ToolsDuring an authorized web application assessment, you identify a GET parameter that appears injectable: https://target.example/products.php?id=12. The application returns different page content when a single quote is appended, but verbose database errors are disabled. Your goal is to safely confirm SQL injection, fingerprint the back-end DBMS, and enumerate available databases with minimal manual trial-and-error. Which tool is the most appropriate choice for this task?
- A
sqlmap, using the injectable URL as input to automate detection, DBMS fingerprinting, and enumeration
- B
John the Ripper, because it can test the parameter for SQL injection and recover database schema details
- C
Hydra, because it can brute-force the web form and identify the underlying DBMS from response timing
- D
Wireshark, because packet captures can automatically enumerate database names from encrypted HTTP sessions
Show answer and explanation
Correct answer: A
Explanation
The key requirement in this scenario is to confirm SQL injection, identify the DBMS, and enumerate databases efficiently when verbose errors are disabled. sqlmap is specifically built for this purpose and is commonly referenced in penetration testing workflows for automated SQL injection detection and exploitation. In CEH-style practical scenarios, choosing the correct class of tool is essential: sqlmap is for SQLi testing and exploitation; John the Ripper is for password cracking; Hydra is for online credential brute-forcing; and Wireshark is for packet capture and protocol analysis. Best practice in authorized assessments is to begin with careful validation of the injectable parameter and then use a purpose-built tool such as sqlmap to minimize manual guesswork while staying within scope. Relevant references include the sqlmap project documentation for supported SQL injection techniques and OWASP guidance on SQL Injection testing methodology.
- A. Correct.
Correct. sqlmap is a widely used automated SQL injection exploitation and detection tool that can test injectable parameters, fingerprint the back-end database, and enumerate databases, tables, and other metadata when authorized. In a scenario where errors are suppressed and the tester wants to reduce manual effort, sqlmap is the most appropriate tool among the options. It supports techniques such as boolean-based, time-based, error-based, UNION query-based, and stacked queries where applicable, making it practical for real-world assessments.
- B. Incorrect.
Incorrect. John the Ripper is primarily a password cracking tool used for offline hash cracking and related credential attacks. It is not designed to detect SQL injection vulnerabilities in web parameters or enumerate database schema through SQLi exploitation. Someone might choose it because databases can contain password hashes, but that would only be relevant after data extraction, not for identifying and exploiting the injection point itself.
- C. Incorrect.
Incorrect. Hydra is a network logon cracker used to brute-force authentication services such as SSH, FTP, RDP, HTTP forms, and others. It does not perform SQL injection testing or reliable DBMS fingerprinting from injectable parameters. A candidate might confuse brute-forcing web logins with testing web application injection flaws, but they are different attack classes and require different tools.
- D. Incorrect.
Incorrect. Wireshark is a packet analysis tool useful for network troubleshooting and protocol inspection. It does not automatically test a web parameter for SQL injection or enumerate database names from an application-layer injection flaw. Additionally, if the web traffic is protected by HTTPS and decryption keys are not available, Wireshark would not reveal the HTTP contents in a usable way. Even with visibility into traffic, it would not replace a dedicated SQLi assessment tool.