CCNA Web Application and Injection Attacks Questions

SQLMap automates detection and exploitation of SQL injection in web applications, fingerprinting the backend DBMS and dumping data via crafted payloads. This directly matches the stem's requirement for a tool specifically built to automate SQL injection detection and exploitation, rather than general web scanners.

Directory traversal, also known as path traversal, is a vulnerability that allows an attacker to access files and directories stored outside the intended root directory by manipulating file paths. This is typically achieved by injecting sequences like `../` (dot-dot-slash) into input parameters, enabling navigation upwards in the directory hierarchy to read sensitive system files or application configuration.

Custom request headers like X-Requested-With serve as an effective CSRF defense by leveraging browser security mechanisms. Modern browsers, adhering to the Same-Origin Policy and CORS specifications, prevent attackers from arbitrarily adding or modifying such custom headers in simple cross-origin requests. The server can then validate the presence and expected value of this header, rejecting any request originating from an unauthorized domain that lacks the legitimate header. This ensures that only requests from the legitimate origin, which can set the header, are processed.

When user-supplied data is rendered back to a client, output encoding converts special characters (like <, >, &, ", ') into their entity equivalents (e.g., &lt;, &gt;). This process prevents the browser from interpreting these characters as active content or HTML tags, effectively neutralizing any embedded malicious scripts and ensuring they are displayed as harmless text rather than executed.

Password spraying is a targeted attack where an attacker attempts a small number of common passwords against a large list of usernames. This technique is specifically designed to bypass account lockout policies by distributing login attempts across many accounts, rather than repeatedly failing on a single account. By trying 'Password123!' on hundreds of accounts, the attacker significantly increases their chances of finding a valid credential without triggering security alerts for excessive failed logins on one user. This method is highly effective against organizations with weak password policies and large user bases.

Time-based blind SQL injection is a technique where an attacker infers information by observing the time it takes for the database to respond to a query. This method involves injecting SQL commands that include conditional statements (e.g., IF or CASE) combined with time-delay functions (e.g., SLEEP() or WAITFOR DELAY). If the condition is true, the database introduces a noticeable delay, allowing the attacker to deduce the truthfulness of a statement bit by bit, even without direct error messages or data output.