In the context of injection flaws, attackers are trying to do what?

• A. Exfiltration of data
• B. They are trying to get the computer to run some code or script that it should not
• C. Denial of service
• D. Password guessing

Answer: (B)

Injection flaws happen when untrusted input is treated as part of a command or query by an interpreter (like a SQL query or a shell command). The attacker’s goal is to make that interpreter execute code or a script that it should not, effectively causing the system to run unauthorized instructions. That makes this option the best fit because it captures the core objective of injection flaws: forcing the system to execute unintended code.

Data exfiltration can be a downstream result, but it isn’t the primary aim of the flaw itself. Denial of service and password guessing aren’t inherent goals of injection flaws, which revolve around executing unintended commands or scripts rather than simply consuming resources or guessing credentials.