Which term describes an attacker’s technique that manipulates the application by injecting code via input fields and comments?

Which term describes an attacker’s technique that manipulates the application by injecting code via input fields and comments?

• A. End of Line Comment
• B. Fuzzing
• C. Threat Modeling
• D. Risk Management

Answer: (A)

End-of-line comment attacks happen when an attacker injects code through input fields and uses a comment marker to end the rest of the line. When the application incorporates that input into a statement or query, the comment marker makes the parser ignore everything after it, allowing the attacker’s payload to take effect or to bypass part of the intended logic. For example, in a SQL query the app might build something like: SELECT * FROM users WHERE username = 'input'. If the attacker supplies alice' --, the line becomes SELECT * FROM users WHERE username = 'alice' --; and the rest of the line is treated as a comment, potentially altering authentication checks or the query’s behavior. That’s why this description matches the technique: it deliberately leverages input to inject code and uses the comment syntax to terminate the rest of the line. Fuzzing, threat modeling, and risk management describe broader testing and process activities rather than the specific method of injecting payloads via comments. To defend, use parameterized queries, proper input validation and escaping, and avoid dynamically building code or queries from user input.

End-of-line comment attacks happen when an attacker injects code through input fields and uses a comment marker to end the rest of the line. When the application incorporates that input into a statement or query, the comment marker makes the parser ignore everything after it, allowing the attacker’s payload to take effect or to bypass part of the intended logic.

For example, in a SQL query the app might build something like: SELECT * FROM users WHERE username = 'input'. If the attacker supplies alice' --, the line becomes SELECT * FROM users WHERE username = 'alice' --; and the rest of the line is treated as a comment, potentially altering authentication checks or the query’s behavior.

That’s why this description matches the technique: it deliberately leverages input to inject code and uses the comment syntax to terminate the rest of the line. Fuzzing, threat modeling, and risk management describe broader testing and process activities rather than the specific method of injecting payloads via comments. To defend, use parameterized queries, proper input validation and escaping, and avoid dynamically building code or queries from user input.