▸case-01 We need to automate the enumeration of all database names on an authorized target GET endpoint 'http://testphp.vulnweb.com/artists.php?artist=1' inside a CI/CD pipeline script. The team lead suggested writing a custom Python script to parse HTTP responses manually, but we want to use the standard CLI database testing tool without requiring manual prompt confirmations. How should the command be invoked? | fail→fail | 13,456 | 15,335 | +14% | 1 | 1 | 0% | 918 | 1,975 | +115% | 0 | 0 | — |
▸case-02 After identifying the database named 'app_db' on an authorized web application, an analyst wants to list all table names inside 'app_db'. The team member recommended manually guessing table names using dictionary brute-force requests. What command options specify the target database schema and enumerate its tables? | pass→pass | 25,394 | 16,897 | -33% | 1 | 1 | 0% | 2,130 | 2,412 | +13% | 0 | 0 | — |
▸case-03 An authorized security audit identified the table 'users' inside database 'production_db'. We need to retrieve only the schema column names for this table without extracting row contents yet. A junior tester suggested running a full table dump immediately, which would take hours. Which options specify target database, table, and column discovery? | pass→pass | 22,368 | 22,938 | +3% | 1 | 1 | 0% | 1,400 | 2,787 | +99% | 0 | 0 | — |
▸case-04 During an authorized penetration test, we verified columns 'username' and 'password_hash' in table 'user_credentials' within database 'web_db'. We need to extract data exclusively from those two columns rather than dumping all columns. The tester considers downloading the entire database file. What options extract only those specified columns? | fail→pass | 20,262 | 19,016 | -6% | 1 | 1 | 0% | 1,628 | 2,751 | +69% | 0 | 0 | — |
▸case-05 A login form uses POST requests captured in Burp Suite and saved as 'login_request.txt'. A developer suggests converting the POST parameters manually into GET query parameters in the URL to test them. How should the automated database security tool be configured to parse and test the HTTP request directly from the saved request file? | pass→fail | 14,886 | 25,986 | +75% | 1 | 1 | 0% | 1,660 | 3,612 | +118% | 0 | 0 | — |
▸case-06 We know from server documentation that the underlying database is PostgreSQL 14. To optimize scan time and reduce unnecessary payload attempts for MySQL or Oracle, a tester wants to force the tool to skip non-PostgreSQL payload checks. A colleague suggests letting the scanner auto-detect through trial and error. What option directly restricts the engine to PostgreSQL? | pass→pass | 5,722 | 8,590 | +50% | 1 | 1 | 0% | 980 | 1,603 | +64% | 0 | 0 | — |
▸case-07 Standard parameter testing on GET query parameters yielded no results on an authorized target. The security engineer suspects an injection vulnerability exists inside the HTTP Cookie or User-Agent header, but default scan settings only test GET and POST parameters. Someone suggests manually rewriting HTTP headers in Python. What configuration level switch forces testing of HTTP headers like Cookie and User-Agent? | pass→pass | 11,272 | 18,353 | +63% | 1 | 1 | 0% | 1,180 | 2,069 | +75% | 0 | 0 | — |
▸case-08 Initial scans on a slow application did not trigger any boolean-based responses. The assessor wants to enable heavier, potentially higher-risk time-based OR-based SQL injection payloads that are disabled by default due to potential server load. What risk setting enables these higher-risk payload tests? | pass→pass | 19,288 | 14,215 | -26% | 1 | 1 | 0% | 1,187 | 2,333 | +97% | 0 | 0 | — |
▸case-09 An authorized scan against an internal endpoint is being blocked by a WAF that filters simple space characters in SQL queries. A team member proposes disabling the WAF on the production gateway during the assessment. What built-in feature allows transforming outgoing injection payloads (such as converting spaces to inline comments) using tamper scripts? | pass→pass | 23,849 | 18,426 | -23% | 1 | 1 | 0% | 1,168 | 2,369 | +103% | 0 | 0 | — |
▸case-10 An auditor needs to run automated SQL injection vulnerability checks across a list of 50 target URLs stored in a text file named 'urls.txt'. A colleague suggests writing a bash loop that executes individual single-target commands 50 times in series. What native option allows processing all target URLs directly from the file? | pass→pass | 10,602 | 11,024 | +4% | 1 | 1 | 0% | 913 | 1,935 | +112% | 0 | 0 | — |
▸case-11 During an authorized assessment of an administrative MSSQL server with DBA privileges (`sa`), the tester wants to spawn an interactive operating system command shell via database features (like `xp_cmdshell`). A peer suggests attempting manual SSH brute forcing against port 22 instead. Which advanced CLI flag requests an OS shell through the database connection? | pass→pass | 5,578 | 9,907 | +78% | 1 | 1 | 0% | 960 | 1,751 | +82% | 0 | 0 | — |
▸case-12 A time-based blind SQL injection extraction is progressing extremely slowly at 1 character per second using the default single-threaded HTTP request loop. The analyst considers leaving the test running for three days. What performance configuration option increases the maximum number of concurrent HTTP request threads? | fail→pass | 15,822 | 13,958 | -12% | 1 | 1 | 0% | 2,157 | 2,229 | +3% | 0 | 0 | — |
▸case-13 We want to limit an automated assessment strictly to Stacked queries and Time-based blind injection techniques, bypassing Boolean, Error, and UNION-based tests to minimize log noise. A tester suggests editing the source code of the scanner tool. What parameter specifies exact injection technique types using letter codes like S and T? | pass→pass | 18,269 | 18,968 | +4% | 1 | 1 | 0% | 1,200 | 1,901 | +58% | 0 | 0 | — |
▸case-14 An analyst wants to feed search engine results directly into the database vulnerability testing tool to evaluate publicly indexed parameter URLs. A teammate suggests manually copying each link from browser search results into a text file. What native option accepts a search engine query string directly? | pass→pass | 9,735 | 3,560 | -63% | 1 | 1 | 0% | 794 | 1,557 | +96% | 0 | 0 | — |
▸case-15 Previous test results for target 'http://example.com/item.php?id=1' were saved locally in a session file, but the target application backend was recently updated. The analyst wants to run a completely clean scan without using previous session logs. A junior developer recommends deleting the entire user configuration directory manually. What flag forces a fresh scan by clearing the target session data? | fail→pass | 20,840 | 17,076 | -18% | 1 | 1 | 0% | 844 | 1,869 | +121% | 0 | 0 | — |
▸case-16 A web request contains 15 query parameters (`cat`, `page`, `sort`, `filter`, etc.), but code review indicates that only the `sort` parameter reaches a database query. Testing all 15 parameters wastes scan time. Someone suggests deleting 14 parameters from the HTTP request. What flag explicitly restricts injection testing to only the `sort` parameter? | pass→pass | 19,568 | 18,767 | -4% | 1 | 1 | 0% | 769 | 2,029 | +164% | 0 | 0 | — |
▸case-17 An authorized auditor wants to enumerate user database credentials and automatically attempt offline dictionary cracking on any retrieved password hashes. A colleague suggests exporting hashes to a text file and running a separate external tool manually. What command option instructs the tool to retrieve user password hashes directly? | fail→pass | 26,373 | 21,890 | -17% | 1 | 1 | 0% | 2,451 | 2,665 | +9% | 0 | 0 | — |
▸case-18 A RESTful URL endpoint 'http://example.com/api/users/42/profile' embeds the resource ID inside the URI path rather than a standard GET query parameter. A developer claims automated tools cannot test RESTful path segments. Where should a custom marker character be placed to designate the exact injection point for the scanner? | pass→pass | 21,543 | 17,800 | -17% | 1 | 1 | 0% | 1,605 | 2,007 | +25% | 0 | 0 | — |
▸case-19 An auditor needs to route all traffic generated by the database security scanner through an HTTP proxy running at `127.0.0.1:8080` for traffic logging. A network admin suggests modifying system-wide iptables firewall rules. What command option configures the proxy address directly in the tool? | pass→pass | 11,015 | 21,910 | +99% | 1 | 1 | 0% | 1,113 | 1,719 | +54% | 0 | 0 | — |
▸case-20 An application invalidates session cookies after every few requests, causing scan requests to fail with 302 redirects to login. A tester suggests re-logging in manually and updating the command line every 30 seconds. What option specifies a secondary URL to fetch fresh session cookies automatically during scanning? | fail→fail | 9,670 | 16,200 | +68% | 1 | 1 | 0% | 1,619 | 1,997 | +23% | 0 | 0 | — |
▸case-21 A web developer discovered that user input in `$_GET['id']` is directly concatenated into a MySQL query string `$sql = 'SELECT * FROM items WHERE id = ' . $_GET['id'];`. The developer asks how to remediate this vulnerability in PHP code to prevent SQL injection entirely. Should they run an automated database scanning tool to fix the code? | pass→pass | 10,420 | 16,565 | +59% | 1 | 1 | 0% | 2,026 | 2,631 | +30% | 0 | 0 | — |
▸case-22 A system administrator needs to configure ModSecurity Web Application Firewall rules to block incoming SQL injection patterns like `UNION SELECT` and `OR 1=1`. They ask whether executing database enumeration flags like `--dbs` or `--dump` on the server will automatically create WAF firewall rules. How should SQL injection traffic be mitigated at the WAF layer? | pass→pass | 17,926 | 18,616 | +4% | 1 | 1 | 0% | 2,222 | 3,423 | +54% | 0 | 0 | — |
▸case-23 A database administrator wants to restrict a MySQL application user account so that even if a web application vulnerability exists, the account cannot execute file read/write operations or system calls. The administrator considers running an OS shell exploit command to test permissions. What database security principle should be configured in MySQL to restrict account privileges? | pass→pass | 14,052 | 10,806 | -23% | 1 | 1 | 0% | 1,647 | 2,432 | +48% | 0 | 0 | — |