SQL INJECTION---WEBSITE TAKEOVER BY ADMIN PRIVILEGE

LIKE & SUBSCRIBE FOR MORE VIDEOS

CRACK INTERVIEW LIKE A MASTER
SQL Injection?

SQL injection is a code injection technique that might destroy your database.
SQL injection is one of the most common web hacking techniques.
SQL injection is the placement of malicious code in SQL statements, via web page input.

Top 10 Interview Questions: SQL Injection | OWASP | Application Security

Here is a list of top 5 interview questions related to SQL injection. SQL injection is the topmost vulnerability in OWASP Top 10.

Q1. What is SQL Injection?

Ans: SQL injection is a vulnerability by which an attacker execute malicious SQL queries on the backend database by manipulating the input to the application.

Q2. Is it just ASP and SQL Server or are all platforms vulnerable?

Ans: SQL injection is the most widespread vulnerability among all platforms. Improper input validation and use of dynamic SQL queries are the main causes of SQL injection.

Q3. Apart from username and password which variables are candidates for SQL Injection?

Ans: Any input field like credit card number, account number etc. which extracts data from database by using where clause are the candidates of SQL injection. In addition to form fields, an attacker can use hidden fields and query strings for successful exploitation.

Q4. What’s the worst an attacker can do with SQL?

Ans: SQL, is a language used to create and manage database stored in RDBMS. If SQL injection vulnerability is available in the application, the following are the possibilities:

Bypass authentication may possible
confidentiality of data may be lost as an attacker may able to see data on exploiting SQL injection vulnerability
attacker can delete entries in the database
an attacker can alter data in the database
Q5. What is Blind SQL Injection?

Ans: Blind SQL Injection is a type of SQL injection where an attacker asks true and false questions to the database. Based on error messages, attacker craft more specific questions to the database to extract more information. This is little difficult to exploit, but not impossible.