Exercise 7 - Question 9

Question

For Question 9 in Exercise 7. Can we assume that the attacker is able to manually browse through all the returned rows that are returned by a query, since we only know the format of the table but not how many rows it contains?

For example, if the query is `SELECT * FROM users`, is the attacker able to browse through each row and see the values of the columns `admin` and `password`? (i.e. the returned number of rows is not too large).

Edit: additional follow-up question, can we also assume that `admin` is always present in the `users` table ?

Answer 1

1) The information that is visible to the attacker is restricted in each question. You can assume that the response data is not truncated, i.e. there is no limit on the size of the response.

2) You can assume that `admin` is always present in the `users` table.