CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use out-of-band SQL injection with DNS exfiltration

  Why it's wrong here

  Using out-of-band SQL injection with DNS exfiltration is inappropriate in this scenario because the application explicitly returns database error messages. Out-of-band techniques, such as those leveraging DNS queries, are primarily employed when direct communication channels are restricted, and no immediate feedback (like error messages or visible data) is available. Since the analyst observes verbose error messages, a more direct and efficient error-based approach is feasible, negating the need for the complexity of out-of-band methods.

• ✗

  Use a time-based blind SQL injection with SLEEP() function

  Why it's wrong here

  Using a time-based blind SQL injection with `SLEEP()` is inappropriate here because the scenario explicitly states the application returns database error messages. These errors provide direct feedback, negating the need for blind techniques. Time-based methods are specifically employed when no direct output or error messages are available, allowing an attacker to infer data or confirm injection based solely on response delays, making it a vital technique for truly blind SQL injection scenarios.

• ✓

  Leverage error-based SQL injection with CONVERT() or double query

  Why this is correct

  Leveraging error-based SQL injection with functions like CONVERT() or by employing double query techniques (e.g., using `EXTRACTVALUE` or `UPDATEXML` in MySQL) is highly effective when an application displays verbose database error messages. These methods intentionally trigger type conversion errors or XML parsing errors, forcing the database to include the results of an injected subquery within the error message itself. This allows the attacker to directly extract data, such as database version, table names, or user credentials, from the application's response.

• ✓

  Use SQLMap with --union-col and --union-from flags

  Why this is correct

  SQLMap is a powerful automated tool that can effectively perform various types of SQL injection, including union-based, which is a common method for data extraction. The `--union-col` flag helps SQLMap automatically determine the correct number of columns required for a successful `UNION` query, while `--union-from` assists in identifying suitable tables and columns for data retrieval. While error-based injection is also viable here, SQLMap provides an efficient, automated approach to discover and exploit such vulnerabilities, making it a valid and practical technique for an analyst.

• ✗

  Implement parameterized queries in the application code

  Why it's wrong here

  Implementing parameterized queries in the application code is a robust defensive measure against SQL injection, not an exploitation technique. Parameterized queries work by separating the SQL code from user-supplied data, ensuring that input values are treated as literal data rather than executable commands. As an ethical hacker, the analyst's role is to identify and exploit vulnerabilities, not to implement code fixes, making this option irrelevant to the task of exploiting the observed SQL injection.

Go deeper

Related to this question