A county search box returns database-flavored errors that suggest SQL injection. What should the tester do before any broad automated dumping?
Select an answer to reveal the explanation.
Short Explanation
Weird SQL errors are a smoke alarm, not a green light to vacuum the whole citizen database. First confirm the injection class gently, gather enough proof for the report, and keep RoE limits in mind. Dump-everything energy is how assessments turn into incidents.
Full Explanation
Database-flavored errors that suggest SQL injection call for careful confirmation of the injection class and disciplined evidence collection before any broad automated dumping. A county search box showing such errors is a lead, not a license to extract every citizen table—RoE and privacy for residents constrain how impact is proven.
Immediately dumping all citizen tables maximizes harm and page count, not professionalism. Posting raw errors and connection strings publicly leaks sensitive operational detail. Disabling the database to hide errors damages availability and is not a test technique.
Exam caveat: confirm → minimize evidence → report; avoid destructive or mass-exfil automation on civic data stores. CPTS SQLi judgment emphasizes control and data minimization.
Operational check: validate the injection with minimal benign probes, capture proof needed for the municipal report, avoid selecting unnecessary PII columns, and coordinate if deeper proof is required. If deeper proof is required, use a synthetic or low-sensitivity column and redact outputs before the county report leaves the engagement environment. Privacy review of SQLi evidence is mandatory when county databases hold citizen records.