The user inserts a crafted code in a search textbox of a web application; the application takes more than normal time and displays massive amount of result.
-
Social Engineering.
-
SQL Injection.
-
Log Injection.
-
Reflected XSS.
SQL Injection involves inserting malicious SQL code into input fields like search boxes. The 'crafted code' causes the database to execute unintended queries, returning excessive data ('massive amount of result') and slowing response time. Social engineering tricks people, log injection targets logs, and reflected XSS requires script execution in responses.
Injecting crafted input into a search field that causes the application to take abnormally long and return an oversized result set is a classic symptom of SQL Injection — e.g., an attacker inserts something like ' OR '1'='1 (or a UNION-based payload) into an unsanitized query parameter, altering the underlying SQL so it matches far more rows than intended (or runs an expensive injected subquery), causing both the performance hit and the bloated output. Social Engineering involves manipulating people, not code; Log Injection targets log files via injected control characters, not query results; Reflected XSS causes malicious script execution in the browser, not a slow, oversized data dump from the backend.