Types of SQL Injection Attacks
Which THREE of the following are types of SQL injection attacks? (Select 3)
Quick Answer
The answer is Out-of-band SQL injection, along with In-band SQL injection and Blind SQL injection, which are the three primary types of SQL injection attacks recognized on the CEH exam. Out-of-band attacks rely on a different communication channel—such as DNS or HTTP requests—to exfiltrate data when the database cannot return results directly or synchronously, making it distinct from the other two categories. On the Certified Ethical Hacker exam, this classification tests your ability to distinguish between attack vectors based on how data is retrieved: in-band uses the same channel for attack and results, blind relies on inferential responses like boolean or time-based triggers, and out-of-band uses an alternative channel. A common trap is confusing blind SQL injection with out-of-band, but remember that blind attacks still use the primary response channel for inference, whereas out-of-band requires a separate protocol. Memory tip: think "Same, Side, Silent" for In-band, Out-of-band, and Blind.
⚠ Common exam trap
Many exam-takers confuse 'DOM-based' (an XSS attack) with a SQL injection type, or mistakenly think 'Stored SQL injection' is a primary category, when the CEH exam strictly recognizes in-band, blind, and out-of-band as the three main types of SQL injection attacks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Blind SQL injection (boolean-based, time-based)
Blind SQL injection is a recognized type of SQL injection attack where the attacker does not receive direct error messages or data from the database but instead infers information by observing the application's response (boolean-based) or by causing time delays (time-based). This technique is commonly used when the application is configured to suppress error output, forcing the attacker to rely on side-channel behaviors.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DOM-based SQL injection
Why it's wrong here
DOM-based is a type of XSS, not SQL injection.
- ✗
Stored SQL injection
Why it's wrong here
Stored is a type of XSS; SQL injection is categorized by technique.
- ✓
Blind SQL injection (boolean-based, time-based)
Why this is correct
Blind infers results without direct output.
- ✓
In-band SQL injection (error-based, union-based)
Why this is correct
In-band uses the same channel to launch and retrieve results.
- ✓
Out-of-band SQL injection
Why this is correct
Out-of-band uses a different channel (e.g., DNS, HTTP) to exfiltrate data.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A penetration tester attempts a SQL injection on a login form and receives no error messages, but notices a delay in the server response when injecting ' OR SLEEP(5)--. Which type of SQL injection is this?
medium- A.Union-based SQL injection
- B.Boolean-based blind SQL injection
- ✓ C.Time-based blind SQL injection
- D.Error-based SQL injection
Why C: Time-based blind SQL injection relies on inducing a time delay to infer the truth of a condition, as no error or data is returned.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.