What Are the Three Main Types of SQL Injection?
Which THREE of the following are types of SQL injection attacks? (Choose 3)
Quick Answer
The answer is blind (inferential) SQL injection, which includes both boolean-based and time-based variants. These are correct because they allow an attacker to extract information from a database without seeing direct error messages or data output; instead, the attacker infers truth values from changes in application behavior—such as a true/false response in boolean-based SQLi or a delay in server response in time-based SQLi. On the Certified Ethical Hacker CEH exam, this question tests your understanding of how SQL injection attacks are categorized, often appearing alongside in-band SQLi and out-of-band SQLi as the three main types. A common trap is confusing blind SQLi with out-of-band SQLi, but remember that blind SQLi relies on the same communication channel for inference, while out-of-band uses a separate channel like DNS or HTTP. For the exam, a helpful memory tip is: “Blind means no direct sight—you feel the truth through behavior or time.”
⚠ Common exam trap
EC-Council often tests candidates by mixing SQL injection categories with XSS terminology (stored/reflected) to see if they confuse web attack types; the trap here is that 'stored' and 'reflected' are not SQLi types but XSS variants.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Out-of-band SQLi (e.g., DNS or HTTP exfiltration)
Option A is correct because out-of-band SQLi is a recognized SQL injection category in which the attacker uses a separate channel such as DNS or HTTP requests to exfiltrate data when the database server cannot return results directly through the application response. Option C is correct because in-band SQLi is the classic SQL injection type where results are returned in the same communication channel, typically via error-based or UNION-based techniques that leverage database error messages or UNION SELECT statements. Option D is correct because blind (inferential) SQLi is a standard SQL injection category where no data is directly returned; instead, attackers infer information using boolean-based true/false responses or time-based delays such as WAITFOR DELAY or SLEEP. Option B is not a recognized SQLi type; 'stored' describes stored XSS, not SQL injection, even though stored procedures can be involved in SQLi. Option E is also not a SQLi category; 'reflected' describes reflected XSS, where malicious script is echoed back by the application rather than injected into SQL queries.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Out-of-band SQLi (e.g., DNS or HTTP exfiltration)
Why this is correct
Out-of-band SQLi exfiltrates data through a separate channel such as DNS or HTTP requests, used when in-band and inferential techniques are blocked. It is a recognised SQL injection category, satisfying the question's requirement for attack types.
- ✗
Stored SQLi
Why it's wrong here
Stored SQLi is a genuine SQL injection type, so it is a correct answer rather than an incorrect option. It is tempting to reject because the stem asks for three types and stored is often confused with persistent XSS, but stored SQLi legitimately describes malicious input persisted in the database.
- ✓
In-band SQLi (error-based or union-based)
Why this is correct
In-band SQLi exploits the same communication channel for both injection and result retrieval, using error messages or UNION operators to extract data directly. This satisfies the stem's requirement for a recognised SQL injection category, alongside inferential and out-of-band types, making it one of the three correct selections.
- ✓
Blind (inferential) SQLi (boolean- or time-based)
Why this is correct
Blind SQLi infers data without direct output, using boolean true/false responses or time delays to extract information one bit at a time. It is a recognised SQL injection category, satisfying the question's requirement for attack types.
- ✗
Reflected SQLi
Why it's wrong here
Reflected SQLi is not a recognised SQL injection category; the standard classifications are in-band, blind and out-of-band, with stored and error-based as sub-types. The term is tempting because reflected XSS is a genuine vulnerability class, so the name sounds familiar, but it describes cross-site scripting, not SQL injection.
Go deeper
Related to this question
Learn chapter
SQL Injection
Key term
SQL injection
SQL injection is a web security vulnerability that allows an attacker to interfere with the queries an application makes to its database, often to read, modify, or destroy data.
Key term
Cross Site Scripting XSS
Cross Site Scripting (XSS) is a web security vulnerability where an attacker injects malicious scripts into web pages viewed by other users, enabling theft of data or session hijacking.
About these practice questions
Courseiva writes every CEH question from scratch — 913 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE of the following are common types of SQL injection attacks? (Select three)
medium- A.Reflected SQL injection
- B.Stored SQL injection
- ✓ C.Out-of-band SQL injection
- ✓ D.Blind SQL injection
- ✓ E.In-band SQL injection
Why C: The three correct answers are C, D, and E. Out-of-band SQL injection (C) is a recognized type where the attacker uses a different channel (e.g., DNS or HTTP requests via functions like UTL_HTTP or xp_dirtree) to exfiltrate data when the web response does not return query results. Blind SQL injection (D) is a standard category where the attacker infers data by observing boolean true/false responses or time delays (e.g., WAITFOR DELAY, SLEEP), rather than seeing query output directly. In-band SQL injection (E) is the classic category where data is retrieved through the same channel used to inject the payload, typically via UNION-based or error-based techniques. The unmarked options A and B are not standard SQL injection classifications: 'reflected' and 'stored' describe XSS variants, not SQLi types, so they do not belong here.
Variation 2. Which TWO of the following are common types of SQL injection attacks?
easy- ✓ A.Blind SQL injection (boolean-based)
- B.Out-of-band SQL injection
- ✓ C.In-band SQL injection (union-based)
- D.Heap-based SQL injection
- E.NoSQL injection
Why A: In-band SQLi (union-based) uses the same channel to inject and retrieve data. Blind SQLi (boolean-based or time-based) does not return data directly but infers information from behavior. These two are widely considered the most common and fundamental types of SQL injection. NoSQL injection is a separate category targeting NoSQL databases. Heap-based is not a recognized SQLi type. Out-of-band SQL injection is a recognized category, but it is generally considered less common than In-band and Blind SQL injection, which are the primary two categories.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.