You work as a Network Penetration tester in the Secure Inc. Your company takes the projects to test the security of various companies. Recently…

The provided SQL string is a classic example of an SQL injection attack utilizing "stacked queries." The semicolon (;) is used to terminate the initial SELECT statement and begin a new, malicious one: DROP TABLE members. This second command instructs the database to delete the entire members table, including its structure and all contained data. The double-hyphen (--) at the end acts as a comment, neutralizing any subsequent characters from the original server-side query (like a closing single quote), thus preventing a syntax error and ensuring the malicious command executes successfully.

A. This is an SQL injection attack targeting the database, not a Cross-Site Scripting (XSS) attack, which injects malicious scripts into web pages.

C. The DROP TABLE command deletes the entire table. To delete specific rows, a DELETE FROM members WHERE... statement would be required.

D. The command used is DROP TABLE, which affects a specific table, not DROP DATABASE, which would be needed to delete the entire database.

1. Stanford University

CS 155: Computer and Network Security

Lecture 4: Web Security - SQL Injection. This course material explains how attackers can use query separators like the semicolon to append new commands. It explicitly provides an example similar to the question: Robert'; DROP TABLE Students; --

demonstrating how a second

destructive command can be executed. (See slide 22

"Attack II: piggy-backed queries").

Source: Dan Boneh

John Mitchell

"CS 155: Computer and Network Security

" Stanford University

Spring 2018. https://crypto.stanford.edu/cs155/lectures/04-web-security.pdf

2. Microsoft SQL Server Documentation

"DROP TABLE (Transact-SQL)". This official vendor documentation defines the DROP TABLE statement's function: "Removes one or more table definitions and all data

indexes

triggers

constraints

and permission specifications for those tables." This confirms that the command deletes the entire table

not just rows or the database.

Source: Microsoft

"DROP TABLE (Transact-SQL)

" SQL Server Docs. https://docs.microsoft.com/en-us/sql/t-sql/statements/drop-table-transact-sql

3. PostgreSQL 14 Documentation

"3.5. Combining Queries". This documentation explains how multiple SQL statements can be sent from a client in a single string

separated by semicolons. It states

"The psql program and most other database clients also execute semicolon-separated statements one by one

" which is the mechanism exploited by this injection attack.

Source: PostgreSQL Global Development Group

"PostgreSQL 14 Documentation

" Chapter 3. SQL Language

Section 3.5. Combining Queries. https://www.postgresql.org/docs/14/tutorial-sql-intro.html