CEH Web Application and Injection Attacks Practice Question
A web application is vulnerable to SQL injection. Which THREE of the following techniques can be used to extract data from the database using blind SQL injection?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Time-based
Boolean-based, time-based, and out-of-band are all types of blind SQL injection. Error-based and union-based are in-band techniques, not blind.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Time-based
Why this is correct
Time-based blind SQL injection involves injecting queries that cause a measurable time delay on the database server if a specific condition evaluates to true. By observing the server's response time, an attacker can infer the truthfulness of the injected statement, character by character. This method is crucial when no direct output or error messages are returned by the application, making it a viable technique for data exfiltration in blind scenarios.
- ✗
Error-based
Why it's wrong here
Error-based SQL injection is an in-band technique where an attacker intentionally crafts malicious queries that force the database to generate error messages containing sensitive information. These error messages, which might include details like table names, column names, or even query results, are then displayed directly within the web application's response. Since the data is retrieved through the same channel as the legitimate application output, it is not considered a blind SQL injection method.
- ✓
Boolean-based
Why this is correct
Boolean-based blind SQL injection relies on observing subtle differences in the application's HTTP responses (e.g., page content, layout, or status codes) to infer the truthfulness of injected conditions. The attacker sends queries that evaluate to either true or false, and the application's behavior changes accordingly. This allows for character-by-character data extraction without the database directly returning the data in the response.
- ✓
Out-of-band
Why this is correct
Out-of-band SQL injection exploits the database server's ability to initiate external network requests, such as DNS lookups or HTTP requests, to an attacker-controlled server. The attacker injects queries that instruct the database to send extracted data through these alternate communication channels, bypassing the web application's direct response. This method is particularly effective in highly blind scenarios where no direct output or time delays are observable.
- ✗
Union-based
Why it's wrong here
Union-based SQL injection is an in-band technique that uses the `UNION` operator to combine the results of an attacker's malicious query with the results of the original legitimate query. This allows the attacker to retrieve data from other tables or databases and display it directly within the web application's standard response. As the extracted data is returned within the normal application output, it is not classified as a blind SQL injection method.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.