CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Time-based SQL injection

  Why this is correct

  Time-based SQL injection is the correct answer because the scenario explicitly describes inferring information based on *timing differences* in the web application's response. This technique is employed when direct error messages or content changes are not visible to the attacker. Attackers inject SQL queries containing database-specific time-delay functions (e.g., SLEEP() in MySQL, WAITFOR DELAY in MS SQL Server) within a conditional statement. If the injected condition evaluates to true, the database pauses for a specified duration, causing a noticeable delay in the application's response, thereby confirming the truthfulness of the condition and allowing data exfiltration character by character.

• ✗

  Reflected XSS

  Why it's wrong here

  Reflected XSS (Cross-Site Scripting) is incorrect because it involves injecting malicious client-side scripts (typically JavaScript) into a web application, which are then immediately 'reflected' back to the user's browser, often via an error message, search result, or other response that includes user-supplied data. The attack relies on the victim's browser executing the script, leading to actions like session hijacking or defacement. It does not involve inferring server-side information through database delays or timing differences in the application's response.

• ✗

  Blind boolean-based SQL injection

  Why it's wrong here

  Blind boolean-based SQL injection is incorrect because, while it is a form of blind SQL injection, it relies on observing *differences in the application's response content or HTTP status codes* rather than timing. Attackers inject SQL queries that evaluate to true or false, and the application responds differently based on the outcome (e.g., showing a generic error page for false, or a slightly altered layout for true) without directly revealing database errors or data. This method does not involve deliberate delays to exfiltrate information; instead, it analyzes the structure or presence of elements in the HTTP response.

• ✗

  CSRF

  Why it's wrong here

  Cross-Site Request Forgery (CSRF) is incorrect because it is an attack that tricks authenticated users into unknowingly submitting malicious requests to a web application where they are currently logged in. The attacker crafts a forged request, often embedded in an image tag or a hidden form on a malicious website, and relies on the victim's browser automatically including their session cookies. This attack focuses on unauthorized actions performed by the victim through their browser, not on exploiting database vulnerabilities or inferring information through response timing differences from the server.

Go deeper

Related to this question