CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Error-based injection

  Why it's wrong here

  Error-based SQL injection leverages database error messages, such as those generated by functions like `updatexml()` or `extractvalue()`, to reveal information from the database. By crafting malicious queries that intentionally cause specific errors, an attacker can embed query results within the error output returned to the application. This technique is fundamentally designed for data exfiltration by displaying data, not for directly writing files to the server's filesystem, as its output mechanism is limited to error strings.

• ✓

  In-band (file write via INTO OUTFILE)

  Why this is correct

  In-band SQL injection involves using the same communication channel for both injecting the payload and receiving the results, making it a direct interaction. Specifically, the `INTO OUTFILE` clause in SQL allows the result of a query to be written directly to a file on the database server's filesystem. SQLMap utilizes this functionality to upload a webshell or other malicious files, provided the database user has sufficient `FILE` privileges and the target directory is writable, thereby achieving direct file write capability.

• ✗

  Blind boolean-based injection

  Why it's wrong here

  Blind boolean-based SQL injection infers data by observing true/false responses from the application, typically by monitoring HTTP response codes or subtle content changes. The attacker crafts queries that return a boolean result, then iterates through characters or conditions to deduce information one bit at a time without direct output. This method relies entirely on indirect observation and does not provide a mechanism for direct data output or file manipulation, making it unsuitable for writing files to the server.

• ✗

  Union-based injection

  Why it's wrong here

  Union-based SQL injection leverages the `UNION SELECT` operator to combine the results of a malicious query with the results of the original legitimate query. This allows an attacker to retrieve data from other tables or even read local files (e.g., using `LOAD_FILE()`) by injecting a `SELECT` statement into the union. While highly effective for data exfiltration and reading files, the `UNION` operator's primary function is data retrieval, and it does not inherently provide a mechanism to write arbitrary files to the server's filesystem.

Go deeper

Related to this question