Digital Forensic Certification Practice Exam

In a SQL injection attack, which of the following URLs is an example of double-encoded input?

1. http://www.bank.com/accounts.php?id=1%252f%252a*/union%252f%252a/select%252f%252a*/1,2,3%252f%252a*/from%252f%252a*/users--

2. http://www.bank.com/accounts.php?id=1+UnloN/**/SelecT/**/1,2,3--

3. http://www.bank.com/accounts.php?id=1+UNunionION+SEselectLECT+1,2,3--

4. http://www.bank.com/accounts.php?id=1+uni%0bon+se%0blect+1,2,3--

The correct answer is: http://www.bank.com/accounts.php?id=1%252f%252a*/union%252f%252a/select%252f%252a*/1,2,3%252f%252a*/from%252f%252a*/users--

The selected URL is an example of double-encoded input because it demonstrates the practice of encoding special characters more than once to bypass security filters or input validation mechanisms. In this case, the `%25` represents the percent sign (`%`), which is the encoding for a single encoded character in URL encoding. The presence of multiple `%252f`, for example, is actually the representation of a single encoded forward slash (`/`), encoded twice. Therefore, the URL effectively conveys a potentially malicious SQL command while using double encoding to evade typical protections against injection attacks. This can confuse systems that are expected to decode the input only once, possibly leading to execution of unintended commands. URLs that exhibit single encoding or other formats do not display the same characteristics; they either are poorly encoded or lack the level of complexity seen in double-encoded inputs, which is a common tactic employed in more sophisticated SQL injection attacks.