A penetration tester submitted data to a form in a web application, which enabled the penetration tester to retrieve user credentials. Which of the…

The ability to supply crafted data to a web form and subsequently extract user credentials is characteristic of an injection-class vulnerability (e.g., SQL injection). The primary defense recommended by government and academic security guidance is to enforce rigorous server-side input validation (and associated sanitization/parameterization) before the application processes or stores user-supplied data. Implementing such validation prevents malicious input from being interpreted as executable commands, thereby blocking credential disclosure.

A. Multifactor authentication on the server OS protects logons to the host, not the web application code path exploited by the form.

B. Hashing passwords at rest limits post-compromise damage but does not stop an attacker from exploiting the form to read data before hashing occurs.

D. Network segmentation limits lateral movement; it does not address the direct flaw inside the application logic that allows credential extraction.

1. NIST Special Publication 800-53 Rev.5

“System and Information Integrity – SI-10: Input Validation

” pp. 413-414.

2. NIST Special Publication 800-115

“Technical Guide to Information Security Testing and Assessment

” §4.3.3 (Injection Attacks) – recommends input validation to mitigate.

3. MIT OpenCourseWare

6.858 “Computer Systems Security” Lecture 13: SQL Injection

slides 20-22 – emphasizes sanitization/validation of user input as the primary fix.

4. Viega

J.

& McGraw

G. (2019). “Building Secure Software

” Addison-Wesley

Ch. 5

pp. 127-130 – lists input validation as foundational for preventing credential-stealing injections.