CEH Web Application and Injection Attacks Practice Question

A penetration tester is assessing a PHP e-commerce site. The product search page builds its query by concatenating user input directly into a statement executed with mysqli_query(). When the tester submits the string ' OR '1'='1 as the search term, the application returns every product in the catalog instead of an empty result set. The tester wants to confirm the vulnerability and then extract the contents of the users table. Which action should the tester take FIRST?

⚠ Common exam trap

The trap here is assuming that a single anomalous result, such as returning the full product catalog, definitively proves SQL injection without a controlled true/false comparison.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Submit a boolean-based test such as ' AND '1'='2 to observe whether the result set changes predictably, confirming the input reaches the SQL statement.

The tester has observed anomalous behavior but has not yet proven the input modifies the SQL statement. A boolean-based differential test, comparing a logically true condition against a logically false one, isolates the injection from ordinary application quirks and confirms the parameter is concatenated into the query before any extraction tooling or file-writing attempts are justified.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Immediately attempt to write a web shell to disk using SELECT ... INTO OUTFILE to prove impact.
Why it's wrong here
Writing files is a high-impact escalation that should follow, not precede, confirmation. MySQL's secure_file_priv and the web server's file permissions frequently block INTO OUTFILE, so a failure here would not disprove the injection and would generate unnecessary, potentially destructive activity on the target.
✗
Use sqlmap with the --forms flag to automate the entire extraction without any further manual verification.
Why it's wrong here
Automated extraction is a valid later step, but running it before manually confirming the injection point and its DBMS type risks wasted effort and noisy traffic. The tester should first establish exactly how the parameter behaves, since the returned full catalog could also stem from application logic rather than the concatenated query.
✗
Encode the payload with URL encoding and resubmit it, because the raw quote character is being stripped by the browser.
Why it's wrong here
Browsers do not silently strip quote characters from form fields; they transmit them, and the server-side code is what fails to neutralize them. URL-encoding is a transport detail that does not address the absence of parameterized queries and would not change the fundamental behavior being investigated.
✓
Submit a boolean-based test such as ' AND '1'='2 to observe whether the result set changes predictably, confirming the input reaches the SQL statement.
Why this is correct
A true/false pair of payloads cleanly distinguishes an injection from ordinary application behavior. If ' AND '1'='2 returns no products while ' AND '1'='1 returns all, the input is demonstrably altering the query predicate, which is the definitive confirmation a tester needs before escalating to data extraction.

Go deeper

CEH Web Application and Injection Attacks Practice Question

Why each option matters

Option-by-option breakdown

Related to this question