CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Reflected SQL injection

  Why it's wrong here

  Reflected SQL injection is not a recognized or standard classification within the taxonomy of SQL injection attacks. The term "reflected" is primarily associated with Cross-Site Scripting (XSS) vulnerabilities, where malicious script input is immediately reflected back to the user's browser without being stored. SQL injection attacks, by contrast, directly manipulate database queries, regardless of whether the output is "reflected" or stored.

• ✗

  Stored SQL injection

  Why it's wrong here

  Stored SQL injection is not a conventional or widely accepted classification for SQL injection attack types. Similar to "reflected," the term "stored" is predominantly used to describe a type of Cross-Site Scripting (XSS) where malicious code is permanently saved on the target server, such as in a database, and then served to other users. While SQL injection can involve storing data, "stored" itself doesn't define a specific methodology or type of SQL injection attack.

• ✓

  Out-of-band SQL injection

  Why this is correct

  Out-of-band SQL injection occurs when an attacker cannot retrieve data directly through the same communication channel used for the injection. Instead, the attacker leverages the database server's ability to make external network requests, such as DNS lookups or HTTP requests, to exfiltrate data to a server controlled by the attacker. This technique is particularly useful in blind scenarios where traditional in-band methods are not feasible, creating a separate channel for data retrieval.

• ✓

  Blind SQL injection

  Why this is correct

  Blind SQL injection is a sophisticated technique used when a web application is vulnerable to SQL injection but does not display direct database error messages or query results to the attacker. Attackers infer information about the database by observing subtle application responses, such as boolean-based true/false conditions (e.g., page content changes) or time-based delays. This method requires sending numerous carefully crafted queries to extract data one character at a time.

• ✓

  In-band SQL injection

  Why this is correct

  In-band SQL injection is the most common and straightforward type, where the attacker uses the same communication channel to both launch the attack and retrieve the results. This typically involves injecting malicious SQL queries into user input fields, and the database's response, including error messages or query results, is directly displayed within the web application's output. Error-based and Union-based SQL injection are primary examples of in-band techniques.

Go deeper

Related to this question