What attack was indicated when the IDS system picked up the following text coming from the Internet to the web server? select user, password from…

The provided text is a classic example of a SQL Injection (SQLi) attack. The attacker is appending malicious SQL code to an existing query. The UNION SELECT clause is used to combine the results of the original, legitimate query with a new, attacker-controlled query. The INTO OUTFILE clause, specific to databases like MySQL, attempts to write the output of this combined query to a file on the web server's filesystem (/tmp/file1.txt). The trailing -- is a comment operator in SQL, used to nullify the rest of the original application's query to prevent syntax errors.

A. Remote File Inclusion: This attack involves tricking an application into including and executing a file from a remote URL, which is not present in this payload.

B. URL Directory Traversal: This attack uses sequences like ../ to access files outside of the intended directory, which are not used in the provided string.

D. Binary Code in HTTP Headers: The payload is text-based SQL syntax, not executable binary code, and is typically sent in a URL parameter or POST body.

1. MySQL 8.0 Reference Manual: The official MySQL documentation describes the syntax and function of the clauses used in the attack.

Section 13.2.10.1, SELECT ... INTO Statement: "The SELECT ... INTO OUTFILE 'filename' form of SELECT writes the selected rows to a file." This confirms the file-writing behavior.

Section 13.2.10.3, UNION Clause: "UNION is used to combine the result from multiple SELECT statements into a single result set." This confirms the query manipulation technique.

2. Stanford University, CS 155: Computer and Network Security, Lecture 5: This courseware details web security vulnerabilities.

Slide 20, "SQL Injection Example": The lecture illustrates how attackers can use SQL injection to bypass authentication or extract data, using techniques like appending OR 1=1 -- to a query. The provided attack string is a more advanced variant of this fundamental concept.

3. Halfond, W. G., Viegas, J., & Orso, A. (2006). A classification of SQL-injection attacks and countermeasures. Proceedings of the International Symposium on Secure Software Engineering: This peer-reviewed paper provides a taxonomy of SQLi attacks.

Section 2.1.1, Tautologies and Union Query: The paper describes "Union Query" as a type of SQLi where an attacker "appends a UNION SELECT statement to the original query... to extract information from other tables in the database." This directly matches the technique seen in the question. (DOI: https://doi.org/10.1109/ISSSE.2006.24)