Which statement best describes an injection attack?

• A. An attacker crafts input that includes commands which are executed by an interpreter.
• B. An attacker performs a blind SQL query to retrieve data.
• C. An attacker sends encrypted data to bypass input validation.
• D. An attacker floods the server with traffic to exhaust resources.

Answer: (A)

Injection attacks happen when untrusted input is treated as part of a command or query by an application's interpreter, allowing the attacker to cause the system to execute unintended commands. This precisely matches the idea of crafting input that includes commands which the interpreter will execute, such as injecting a shell or database command through improperly handled input. The strength of this description is its breadth: it covers shell injections, SQL injections, and other interpreter-based commands, all by the same underlying flaw—untrusted input being executed as code.

Other statements describe different scenarios. A blind SQL data-retrieval technique is a narrow form of injection focused on extracting data via SQL, not the general concept of injecting commands. Trying to bypass input validation with encrypted data is about evading filters rather than causing an interpreter to execute extra commands. Flooding the server with traffic is a denial-of-service attack, unrelated to the concept of injecting commands into an interpreter.