CEH Web Application and Injection Attacks Practice Question
A security analyst observes a web application returning database error messages containing table names and column names in the HTTP response. Which type of SQL injection is MOST likely being exploited?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Error-based SQL injection
Error-based SQL injection (in-band) relies on error messages from the database to extract information. The presence of database details in errors indicates error-based injection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Blind SQL injection (boolean-based)
Why it's wrong here
Boolean-based blind SQL injection involves sending queries that force the application to return a different response based on a true or false condition, such as a page loading or not loading, or a specific element appearing. It does not directly display database error messages or extracted data within the HTTP response body. Instead, the attacker infers information bit by bit by observing these subtle behavioral differences in the application's response.
- ✗
Union-based SQL injection
Why it's wrong here
Union-based SQL injection leverages the SQL UNION operator to combine the results of an attacker's injected query with the results of the original legitimate query. This technique allows the attacker to retrieve data directly from other tables within the database and display it within the web application's normal output. While it returns data, it does so by appending legitimate result sets, not by triggering and displaying database error messages.
- ✓
Error-based SQL injection
Why this is correct
Error-based SQL injection is a technique where an attacker intentionally causes the database to generate error messages that contain sensitive information. By crafting malicious SQL queries that violate database constraints or syntax rules, the application's response will include detailed error messages, such as those from MySQL's EXTRACTVALUE or UPDATEXML functions, which inadvertently disclose database contents. This method directly "returns data" by embedding it within the visible error output.
- ✗
Out-of-band SQL injection
Why it's wrong here
Out-of-band SQL injection relies on the database server's ability to make external network requests, such as DNS lookups or HTTP requests, to an attacker-controlled server. This method is typically used when direct data retrieval through the web application's HTTP response is not feasible, for instance, in blind scenarios. The extracted data is transmitted over this secondary channel, meaning the web application itself does not "return" the data or display error messages containing it.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.