Digital Forensic Certification Practice Exam

What type of attack did Henry perform when he used SQL injection to access user credentials from a remote server?

1. Internal attack

2. Phishing attack

3. External attack

4. Denial of service attack

The correct answer is: External attack

The scenario describes Henry using SQL injection to access user credentials, which involves exploiting vulnerabilities in a web application's database structure. This technique typically targets an external system, indicating that the attacker is operating from outside the network or system they are attacking. In this context, an external attack refers to unauthorized access initiated from an outside entity attempting to exploit the application. By utilizing SQL injection, Henry is leveraging specific coding weaknesses to retrieve sensitive information from the database, all without direct access to the server itself. This attack does not originate from within the organization but rather from external sources, aligning with the characteristics of an external attack. Understanding the nature of the access is critical, as it defines the approach taken by the security team to respond, investigate, and mitigate the vulnerabilities, highlighting the importance of recognizing whether an attack is internal or external. In this case, since Henry's access to user credentials was achieved through an exploit identified from an outside position, it is classified as an external attack.