CEH Network and Web Application Attacks Practice Question

Exhibit

Refer to the exhibit.

GET /search?q=1 UNION SELECT username,password FROM users-- HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0

HTTP/1.1 200 OK
Date: Mon, 04 Nov 2024 12:00:00 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Type: text/html

<html><body><h1>Search Results</h1><p>admin:5f4dcc3b5aa765d61d8327deb882cf99</p><p>user1:5d41402abc4b2a76b9719d911017c592</p></body></html>

Refer to the exhibit. A penetration tester executed the SQL injection payload and received the response shown. What is the most likely outcome of this attack?

⚠ Common exam trap

EC-Council often tests the distinction between in-band (error-based/UNION) SQL injection, which returns data directly, and blind SQL injection, which does not return visible data; candidates mistakenly choose blind when the response clearly shows extracted values.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The attacker extracted hashed passwords that can be cracked offline

The response shows a successful SQL injection that returned password hashes (likely from the `password` column) in the output. This indicates the attacker exploited a vulnerable parameter to extract hashed credentials from the database, which can then be cracked offline using tools like Hashcat or John the Ripper. The presence of hash strings in the response confirms data extraction, not modification or denial of service.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The attacker extracted hashed passwords that can be cracked offline
Why this is correct
The exhibit clearly shows the successful execution of a UNION SELECT SQL injection query, resulting in the direct retrieval of sensitive user data, specifically username and corresponding password hash pairs. These extracted hashes, likely MD5 given their typical format in such vulnerabilities, are highly susceptible to offline cracking techniques like dictionary attacks or rainbow tables. Once cracked, these plaintext passwords can then be used for further unauthorized access or credential stuffing attacks against other services.
✗
The attacker successfully performed a blind SQL injection to enumerate the database structure
Why it's wrong here
The attacker did not perform a blind SQL injection, which relies on inferring data through true/false responses or time delays without direct output. Instead, the exhibit demonstrates a successful UNION-based SQL injection where the attacker directly received the database's response containing enumerated data. This direct data exfiltration method is fundamentally different from the indirect, inferential nature of blind SQL injection techniques.
✗
The attacker caused a denial of service by sending an invalid query
Why it's wrong here
The query executed successfully, evidenced by the HTTP 200 OK status code and the return of actual data from the database. A denial of service attack would typically manifest as a server error, timeout, or an inability to process legitimate requests, none of which occurred here. The system remained operational and responsive, fulfilling the attacker's data retrieval request without interruption.
✗
The attacker modified the database records to update user passwords
Why it's wrong here
The SQL payload utilized in the exhibit, specifically `UNION SELECT`, is designed for data retrieval, not for modifying database records. To update user passwords, the attacker would need to employ a DML (Data Manipulation Language) statement such as `UPDATE` along with appropriate `SET` and `WHERE` clauses. The current query merely extracts existing information without altering the database's state or content.

Go deeper

CEH Network and Web Application Attacks Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question