What Are the Three Main Types of SQL Injection?
Which THREE of the following are types of SQL injection attacks? (Choose 3)
Quick Answer
The answer is blind (inferential) SQL injection, which includes both boolean-based and time-based variants. These are correct because they allow an attacker to extract information from a database without seeing direct error messages or data output; instead, the attacker infers truth values from changes in application behavior—such as a true/false response in boolean-based SQLi or a delay in server response in time-based SQLi. On the Certified Ethical Hacker CEH exam, this question tests your understanding of how SQL injection attacks are categorized, often appearing alongside in-band SQLi and out-of-band SQLi as the three main types. A common trap is confusing blind SQLi with out-of-band SQLi, but remember that blind SQLi relies on the same communication channel for inference, while out-of-band uses a separate channel like DNS or HTTP. For the exam, a helpful memory tip is: “Blind means no direct sight—you feel the truth through behavior or time.”
⚠ Common exam trap
EC-Council often tests candidates by mixing SQL injection categories with XSS terminology (stored/reflected) to see if they confuse web attack types; the trap here is that 'stored' and 'reflected' are not SQLi types but XSS variants.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Out-of-band SQLi (e.g., DNS or HTTP exfiltration)
Out-of-band SQLi (option A) is correct because it uses a different channel (e.g., DNS or HTTP requests) to exfiltrate data when the attacker cannot receive direct responses from the database. This technique is effective when the database server can initiate outbound network connections, allowing data to be sent to an attacker-controlled server via DNS queries or HTTP requests.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Out-of-band SQLi (e.g., DNS or HTTP exfiltration)
Why this is correct
Out-of-band uses a different channel (e.g., DNS) to receive data.
- ✗
Stored SQLi
Why it's wrong here
Stored is a term for XSS; SQLi is categorized differently.
- ✓
In-band SQLi (error-based or union-based)
Why this is correct
In-band uses the same channel to launch attack and gather results.
- ✓
Blind (inferential) SQLi (boolean- or time-based)
Why this is correct
Blind SQLi does not directly display data; attacker infers based on responses or timing.
- ✗
Reflected SQLi
Why it's wrong here
Reflected is a term for XSS, not SQLi.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE of the following are common types of SQL injection attacks? (Select three)
medium- A.Reflected SQL injection
- B.Stored SQL injection
- ✓ C.Out-of-band SQL injection
- ✓ D.Blind SQL injection
- ✓ E.In-band SQL injection
Why C: In-band SQL injection (including error-based and union-based) are classic types. Blind SQL injection (boolean-based and time-based) are also common. Out-of-band is less common but still a type.
Variation 2. Which TWO of the following are common types of SQL injection attacks?
easy- ✓ A.Blind SQL injection (boolean-based)
- B.Out-of-band SQL injection
- ✓ C.In-band SQL injection (union-based)
- D.Heap-based SQL injection
- E.NoSQL injection
Why A: In-band SQLi (union-based) uses the same channel to inject and retrieve data. Blind SQLi (boolean-based or time-based) does not return data directly but infers information from behavior. These two are widely considered the most common and fundamental types of SQL injection. NoSQL injection is a separate category targeting NoSQL databases. Heap-based is not a recognized SQLi type. Out-of-band SQL injection is a recognized category, but it is generally considered less common than In-band and Blind SQL injection, which are the primary two categories.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.