CEH Web Application and Injection Attacks Practice Question
A penetration tester uses SQLMap with the option '--technique=T --dbms=MySQL --level=5 --risk=3' against a login form. The tool returns results after a delay of several seconds per request. Which SQL injection technique is being used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Time-based blind SQL injection
The 'T' in --technique stands for Time-based blind SQL injection. The delay indicates time-based injection where the database sleeps to cause a response delay.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Out-of-band SQL injection
Why it's wrong here
Out-of-band (OOB) SQL injection leverages the database server's ability to initiate external network requests, such as DNS lookups or HTTP requests, to exfiltrate data or trigger actions. This technique relies on an alternate communication channel to retrieve results, rather than observing application responses or time delays. The 'T' flag in sqlmap specifically targets time-based methods, which are distinct from OOB approaches.
- ✓
Time-based blind SQL injection
Why this is correct
Time-based blind SQL injection is a technique where the attacker infers information by observing the time it takes for the database server to respond to specific queries. By introducing conditional delays (e.g., IF(condition, SLEEP(5), 0)), the presence or absence of a delay indicates whether the condition is true or false. The 'T' option in sqlmap explicitly instructs the tool to employ this method, making it the correct answer.
- ✗
Error-based SQL injection
Why it's wrong here
Error-based SQL injection exploits database error messages to extract information directly from the application's response. Attackers craft malicious queries that intentionally trigger specific database errors, such as type conversion errors or syntax errors, which then reveal parts of the database structure or data within the error message itself. This method relies on visible error output, not the timing of responses, and is not selected by the 'T' flag.
- ✗
Boolean-based blind SQL injection
Why it's wrong here
Boolean-based blind SQL injection determines information by observing subtle differences in the application's HTTP response based on true or false conditions. For instance, a query might return different page content or an altered HTTP status code if a condition is met, such as AND 1=1 versus AND 1=2. This technique infers data by analyzing the page's logical response, not by measuring the time taken for the server to reply, which is distinct from the 'T' option.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.