CEH Web Application and Injection Attacks Practice Question
A security analyst observes a web application returning database error messages containing table names and column names in the HTTP response. Which type of SQL injection is MOST likely being exploited?
⚠ Common exam trap
CEH often tests the distinction between error-based and union-based SQL injection, as both can reveal database information, but error-based specifically relies on error messages while union-based uses the UNION operator to directly retrieve data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Error-based SQL injection
Error-based SQL injection is correct because the attacker deliberately causes the database to throw errors that are reflected in the HTTP response, revealing schema details like table and column names. This technique relies on verbose error messages from the DBMS (e.g., MySQL, MSSQL) to extract information directly. Unlike blind or out-of-band methods, error-based injection provides immediate feedback in the application's output.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Blind SQL injection (boolean-based)
Why it's wrong here
Boolean-based blind SQL injection involves sending queries that force the application to return a different response based on a true or false condition, such as a page loading or not loading, or a specific element appearing. It does not directly display database error messages or extracted data within the HTTP response body. Instead, the attacker infers information bit by bit by observing these subtle behavioral differences in the application's response.
- ✗
Union-based SQL injection
Why it's wrong here
Union-based SQL injection leverages the SQL UNION operator to combine the results of an attacker's injected query with the results of the original legitimate query. This technique allows the attacker to retrieve data directly from other tables within the database and display it within the web application's normal output. While it returns data, it does so by appending legitimate result sets, not by triggering and displaying database error messages.
- ✓
Error-based SQL injection
Why this is correct
Error-based SQL injection is a technique where an attacker intentionally causes the database to generate error messages that contain sensitive information. By crafting malicious SQL queries that violate database constraints or syntax rules, the application's response will include detailed error messages, such as those from MySQL's EXTRACTVALUE or UPDATEXML functions, which inadvertently disclose database contents. This method directly "returns data" by embedding it within the visible error output.
- ✗
Out-of-band SQL injection
Why it's wrong here
Out-of-band SQL injection relies on the database server's ability to make external network requests, such as DNS lookups or HTTP requests, to an attacker-controlled server. This method is typically used when direct data retrieval through the web application's HTTP response is not feasible, for instance, in blind scenarios. The extracted data is transmitted over this secondary channel, meaning the web application itself does not "return" the data or display error messages containing it.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 913 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official EC-Council exam blueprint
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.