CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Union-based SQL injection

  Why it's wrong here

  Union-based SQL injection is ineffective in scenarios where the application does not display the results of the injected query directly on the web page. This technique relies on the `UNION SELECT` operator to combine the results of an injected query with the original query, requiring the attacker to observe the combined output to exfiltrate data. Without visible output, there is no mechanism to retrieve information, making it unsuitable for blind injection scenarios.

• ✗

  Boolean-based blind SQL injection

  Why it's wrong here

  Boolean-based blind SQL injection is not applicable when the application's response remains entirely identical regardless of whether an injected conditional statement evaluates to true or false. This method infers data by observing subtle, discernible differences in the application's behavior, such as a change in content, page length, or HTTP status code, based on the boolean outcome. If no such observable difference exists, this technique cannot be used to extract information.

• ✓

  Time-based blind SQL injection

  Why this is correct

  Time-based blind SQL injection is the appropriate technique when the application provides no direct output and no discernible boolean difference in its responses. This method relies on making the database server pause for a specific duration (e.g., using `SLEEP()`, `WAITFOR DELAY`, or `PG_SLEEP()`) if a particular injected condition is met. By measuring the time taken for the server to respond, the penetration tester can infer the truthfulness of conditions and extract data character by character.

• ✗

  Error-based SQL injection

  Why it's wrong here

  Error-based SQL injection is unsuitable when the application is configured to suppress or sanitize detailed database error messages from being displayed to the user. This technique exploits the database's tendency to output error messages containing sensitive information, such as table names, column names, or even data, when a malformed query is executed. If these error messages are not visible to the attacker, this method cannot be leveraged for data exfiltration.