CEH Web Application and Injection Attacks Practice Question
A security analyst notices that the web application returns different response times when querying user IDs. For example, a valid user ID returns the page in 2 seconds, while an invalid ID returns in 0.5 seconds. The analyst suspects a blind SQL injection vulnerability. Which SQL injection technique is MOST likely being used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Time-based blind SQL injection
Time-based blind SQL injection relies on causing a time delay (e.g., via SLEEP or WAITFOR DELAY) to infer the truth of conditions. The varying response times (2s vs 0.5s) indicate a time-based attack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Error-based SQL injection
Why it's wrong here
Error-based SQL injection exploits vulnerabilities by forcing the database to return error messages containing sensitive information, such as table names, column names, or even data. Attackers craft malicious input that causes an invalid query execution, and the resulting verbose error message is then displayed to the user. This method relies on the application displaying these detailed database errors directly, which is distinct from observing variations in response times.
- ✗
Union-based SQL injection
Why it's wrong here
Union-based SQL injection leverages the UNION SQL operator to combine the results of an attacker-controlled SELECT query with the legitimate query's results. This allows the attacker to retrieve data from other tables or databases and display it directly within the application's normal output. The defining characteristic is the injection of additional data rows or columns into the web page, rather than inferring information through timing variations.
- ✓
Time-based blind SQL injection
Why this is correct
Time-based blind SQL injection is a technique where an attacker infers information by observing the time it takes for the database to respond to a query. This method involves injecting SQL commands that include conditional statements (e.g., IF or CASE) combined with time-delay functions (e.g., SLEEP() or WAITFOR DELAY). If the condition is true, the database introduces a noticeable delay, allowing the attacker to deduce the truthfulness of a statement bit by bit, even without direct error messages or data output.
- ✗
Out-of-band SQL injection
Why it's wrong here
Out-of-band SQL injection involves making the database server initiate an external connection to an attacker-controlled server, typically via DNS lookups or HTTP requests. This technique is used to exfiltrate data when direct data retrieval through the web application's response channel is not possible. It relies on the database's ability to make outbound network calls and the attacker's ability to monitor those calls, rather than observing variations in the application's response time.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.