A county search box returns database-flavored errors that suggest SQL injection. What should the tester do before any broad automated dumping?
Select an answer to reveal the explanation.
Short Explanation
Weird SQL errors are a smoke alarm, not a green light to vacuum the whole citizen database. First confirm the injection class gently, gather enough proof for the report, and keep RoE limits in mind. Dump-everything energy is how assessments turn into incidents.
Full Explanation
Suspicious database errors warrant careful, controlled confirmation of injection behavior and impact. Professional practice prioritizes minimal necessary evidence under the rules of engagement rather than wholesale extraction of sensitive civic data. Public disclosure of connection details and shutting down databases are inappropriate tester actions. Judgment separates proving exploitability from reckless dumping.