PT0-002 Practice Question: During a web application penetration test, a…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  In-band SQL injection

  Why it's wrong here

  In-band SQL injection is a broad class where both the crafted query and its results travel over the same communication channel, typically returning data directly in the HTTP response body. Because the attacker immediately receives the database output, security tools and WAFs can easily detect the anomalous request/response pattern, and server logs record the data leak. This makes it the least stealthy approach for penetration testing, as opposed to time-based blind injection, which sends no visible data.

• ✗

  Error-based SQL injection

  Why it's wrong here

  Error-based SQL injection deliberately forces the database to generate a verbose error message, such as a syntax error or type conversion error, that incorporates the desired data into the displayed error string. These errors appear on the application's default error page and often include stack traces or database version details, immediately drawing attention from both automated scanners and human analysts. Additionally, many WAFs have prebuilt signatures for classic error-based payloads, so this method is loudly detectable and not suitable for a covert test.

• ✓

  Blind SQL injection (time-based)

  Why this is correct

  Time-based blind SQL injection is a stealthy technique where the attacker injects a conditional expression that causes the database to pause for a defined period if a certain condition is true, such as using the IF() function or WAITFOR DELAY. The tester infers the answer to a yes/no question about the database by observing the response latency, and no error messages or query results are ever returned to the client. This makes it ideal for blind tests where output is suppressed, though it requires multiple requests and careful handling of network variability.

• ✗

  Union-based SQL injection

  Why it's wrong here

  Union-based SQL injection leverages the UNION operator to combine the original query's result set with a malicious SELECT, allowing the attacker to extract arbitrary data directly into the application's rendered output. To succeed, the attacker must first determine the exact number of columns and compatible data types, typically by incrementally adding NULLs or causing deliberate no-ops. The extracted data is displayed in the page, making the attack visibly obvious to a security analyst, and the trial-and-error process often triggers errors that are logged.

Go deeper

Related to this question