CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Stored

  Why it's wrong here

  Stored is a type of Cross-Site Scripting (XSS), not SQL injection. In a Stored XSS attack, malicious script is permanently injected into a target application's database or other persistent storage. When a legitimate user later retrieves this stored data, the malicious script is delivered to their browser and executed, leading to session hijacking, defacement, or redirection. This differs fundamentally from SQL injection, which directly manipulates database queries.

• ✗

  DOM-based

  Why it's wrong here

  DOM-based is a specific type of Cross-Site Scripting (XSS), distinct from SQL injection. This vulnerability arises when client-side script processes data from an untrusted source, such as the URL fragment or document.referrer, and writes it into the Document Object Model (DOM) without proper sanitization. The malicious payload is executed entirely within the victim's browser, without ever being sent to the server or interacting with the database in a server-side query manipulation context.

• ✓

  Union-based

  Why this is correct

  Union-based SQL injection is an in-band technique where an attacker leverages the UNION SELECT SQL operator to combine the results of the original legitimate query with a malicious query. This allows the attacker to retrieve data from other tables or databases within the same database server, and have it returned directly in the application's HTTP response. The attacker can then extract sensitive information by carefully crafting the injected SELECT statement.

• ✓

  Blind boolean-based

  Why this is correct

  Blind boolean-based SQL injection is a technique used when an attacker cannot directly see the results of their injected SQL queries in the application's response. Instead, the attacker sends SQL queries that force the application to return a different result based on a true or false condition. By observing subtle changes in the application's behavior, such as page content variations or error messages, the attacker can infer data character by character.

• ✗

  Reflected

  Why it's wrong here

  Reflected is a type of Cross-Site Scripting (XSS), not SQL injection. In a Reflected XSS attack, the malicious script is not permanently stored but is instead "reflected" off a web server. The attacker crafts a URL containing the malicious payload, and when a victim clicks this link, the server processes the request and includes the script in its response, causing it to execute in the victim's browser. This is a non-persistent attack targeting the user's browser, not the backend database.

Go deeper

Related to this question