Questão 4939090

• Banca: FADESP
• Órgão: MPE-PA
• Ano: 2012
• Provas: FADESP - 2012 - MPE-PA - Técnico - Analista de Sistemas - Desenvolvimento
• Disciplina: Banco de Dados
• Assuntos: SQL

Dentre as técnicas de injeção de SQL, há uma que permite encontrar parâmetros injetáveis, descobrir o tipo e versão do SGBD e descobrir informação sobre o esquema relacional, por exemplo, o nome das tabelas e colunas, e tipos de dados das colunas. O nome dessa técnica é

• A. Comandos Incorretos.
• B. Tautologias.
• C. Injeção de Uniões.
• D. Procedimentos Armazenados.

Gabarito: A

Comentários

• Gabarito: A

  Acredito que "Comandos Incorretos" foi uma péssima tradução de "Error-based".

  SQL injections typically fall under three categories: In-band SQLi (Classic), Inferential SQLi (Blind) and Out-of-band SQLi.

  In-band SQLi: The attacker uses the same channel of communication to launch their attacks and to gather their results.

  1. Error-based SQLi—the attacker performs actions that cause the database to produce error messages. The attacker can potentially use the data provided by these error messages to gather information about the structure of the database.
  2. Union-based SQLi—this technique takes advantage of the UNION SQL operator, which fuses multiple select statements generated by the database to get a single HTTP response. This response may contain data that can be leveraged by the attacker.

  Inferential (Blind) SQLi: The attacker sends data payloads to the server and observes the response and behavior of the server to learn more about its structure. This method is called blind SQLi because the data is not transferred from the website database to the attacker, thus the attacker cannot see information about the attack in-band.

  1. Boolean—that attacker sends a SQL query to the database prompting the application to return a result. The result will vary depending on whether the query is true or false. Based on the result, the information within the HTTP response will modify or stay unchanged. The attacker can then work out if the message generated a true or false result.
  2. Time-based—attacker sends a SQL query to the database, which makes the database wait (for a period in seconds) before it can react. The attacker can see from the time the database takes to respond, whether a query is true or false. Based on the result, an HTTP response will be generated instantly or after a waiting period. The attacker can thus work out if the message they used returned true or false, without relying on data from the database.

  Out-of-band SQLi: The attacker can only carry out this form of attack when certain features are enabled on the database server used by the web application. These techniques count on the capacity of the server to create DNS or HTTP requests to transfer data to an attacker.