Question

While reviewing web server logs, a security analyst notices the following code:

GET http://testphp.comptia.org/profiles.php?id=-1 UNION SELECT 1, 2, 3 HTTP/1.1 Host: testphp.comptia.org

Which of the following would prevent this code from performing malicious actions?

(choose one and why)

1. Performing web application penetration testing
2. Requiring the application to use input validation
3. Disabling the use of HTTP and requiring the use of HTTPS
4. Installing a network firewall in front of the application

Answer 1

The given code queries the profiles.php page with malicious script added with the id.

This would give access to the attacker, to manipulate the database at the backend. As we can see in the query string where the attacker is passing the UNION database query to get access to other elements of the database. This is a very common attack called SQL injection where the attacker passes SQL malicious code to backend database and access the database.

This should be avoided at application end only where it can validate the user input and restrict unauthorized access to the backend so that it doesn't pass any SQL injection to the database.

So to avoid this, the application requires user input validation.

Web application penetration testing, using HTTPS, and network firewall won't work in this case because the attacker is injecting SQL code in the query itself very smartly and it will go undetected in these methods.

Hence, the correct answer is:

B.Requiring the application to use input validation

This completes the requirement. Let me know if you have any queries.

Thanks!