CEH Wireless, IoT and Cloud Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Identify vulnerability, then test injection points, then find number of columns, then use UNION to combine results, then extract data

  Why this is correct

  This sequence accurately outlines the methodical approach to a SQL injection attack. It begins by identifying potential input parameters susceptible to injection, followed by confirming the vulnerability through basic payload testing. Subsequently, determining the number of columns in the original query is essential for constructing a valid UNION-based payload. Finally, the UNION operator is leveraged to combine results from the original query with a malicious SELECT statement, enabling the extraction of sensitive data from the database.

• ✗

  Test injection points, then identify vulnerability, then find number of columns, then use UNION, then extract data

  Why it's wrong here

  This order is incorrect because one must first identify *where* a potential SQL injection vulnerability exists within an application's input parameters before attempting to test it. Jumping directly to "test injection points" without prior identification of a specific vulnerable parameter is an inefficient and illogical approach. The identification phase guides the subsequent testing efforts by pinpointing the attack surface.

• ✗

  Identify vulnerability, then find number of columns, then test injection points, then use UNION, then extract data

  Why it's wrong here

  This sequence is flawed because determining the number of columns is an advanced exploitation step that requires a confirmed and working injection point. Attempting to enumerate columns *before* thoroughly testing the injection point's viability with simpler payloads (e.g., error-based or boolean-based tests) is premature. The "test injection points" phase validates the vulnerability's existence and behavior, which is a prerequisite for column enumeration.

• ✗

  Test injection points, then find number of columns, then identify vulnerability, then use UNION, then extract data

  Why it's wrong here

  This order is fundamentally incorrect as it places "identify vulnerability" after both "test injection points" and "find number of columns." It is illogical to attempt to test injection points or enumerate columns without first identifying a potential vulnerability in a specific input parameter. The initial reconnaissance and identification phase is critical for pinpointing *where* an attack might be successful, guiding subsequent testing and exploitation efforts rather than being an afterthought.

Go deeper

Related to this question