A tester who is performing a penetration test on a website receives the following output:
Warning: mysql_fetch_array() expects parameter 1 to be resource, boolean given in /var/www/search.php on line 62
Which of the following commands can be used to further attack the website?
The warning message 'mysql_fetch_array() expects parameter 1 to be resource, boolean given' suggests a potential SQL injection vulnerability in the website's search.php script. This error typically occurs when a query to the database returns a boolean value (false) instead of a resource. SQL injection can be used to manipulate the SQL query to extract data from the database. The command '1 UNION SELECT 1, DATABASE (), 3 --' is designed to exploit SQL injection vulnerabilities by combining the results of the original SQL query with the results of another query that reveals the database name. Therefore, option D is the correct command to further attack the website.
D SQL
The command that can be used to further attack the website is D. 1 UNION SELECT 1, DATABASE (), 3 --. This command is used to determine databases and tables in a SQL injection attack. The warning message indicates there may be a potential vulnerability in the /var/www/search.php file. Command A <script>var adr = '../evil.php?test=' + escape(document.cookie);</script> is used to inject malicious JavaScript code into a website, while command B ../../../../../../../../../../etc/passwd is used to read system files. Finally, command C /var/www/html/index.php;whoami is used to view information
The command that can be used to further attack the website is D. 1 UNION SELECT 1, DATABASE (), 3 --. This is an example of an exploitation technique known as 'sql injection', where malicious SQL commands are inserted into user input fields in order to access confidential information or modify the contents of a database.
Thinking D. Here is more context. https://www.examtopics.com/discussions/comptia/view/66786-exam-pt1-002-topic-1-question-99-discussion/
ddddddd
Answer: D. 1 UNION SELECT 1, DATABASE (), 3 -- Explanation: The output from the tester's penetration test indicates an issue with the mysql_fetch_array() command in the search.php file. This means that the tester is trying to access a MySQL database. Option D is the correct command to further attack the website since it is a SQL injection attack that can be used to access the database. Option A is incorrect since it is an example of a Cross-site Scripting (XSS) attack, which is not relevant to the output of the tester's penetration test. Option B is incorrect since it is a command to access the password file on the server, which is not relevant to the output of the tester's penetration test. Option C is incorrect since it is a command to execute a PHP script, which is not relevant to the output of the tester's penetration test.
The error message mysql_fetch_array() expects parameter 1 to be resource, boolean given indicates a potential SQL injection vulnerability in the website’s search.php script. The appropriate command to further attack the website would be: D. 1 UNION SELECT 1, DATABASE(), 3 -- Explanation: • SQL Injection: The error message suggests that the application is trying to fetch data from a MySQL database, and it may be vulnerable to SQL injection. The UNION SELECT statement is used to combine the results of two or more SELECT statements. By injecting 1 UNION SELECT 1, DATABASE(), 3 --, the tester is attempting to exploit the SQL injection vulnerability to extract the name of the current database.
It was presented a SQL error, so the pentester should try to perform a SQL Injection attack.