SQL & XML Injections

Question 1

What are the 4 main actions inside of SQL that you can use to manipulate?

Answer 1

1. Select - read the data
2. Insert - Write data
3. Delete - remove the data
4. Update - overwrite the data

Question 2

What is Code Injection?

Answer 2

insertion of additional information or code through a data input form from a client to an application

Question 3

On the exam, anytime you see something with an apostrophe and something that equals something, you must automatically think this is..?

Answer 3

SQL injection attempt

Question 4

What is an XML Injection?

Answer 4

Extensible Markup Language

used by web applications for authentication, authorization, or other types of data exchange.

Question 5

What is an XML Bomb?

Answer 5

Billion Laughs Attack

takes an XML file and then uses encoding to encode entities and expand them into exponential sizes, which will consume memory on the host, and potentially crash it.

Question 6

What is an XML External Entity (XXE)?

Answer 6

An attacker that embeds a request for a local resource

Question 7

If you see anything on the exam with XML written in it, what should you assume?

Answer 7

XML vulnerability

Might be called XML exploitation or XML Injection