PEN-200 Web Application Attacks Practice Question
During a web application assessment, you identify a blind SQL injection vulnerability in a cookie parameter. The backend database is PostgreSQL. You want to determine the first character of the database name using a time-based injection. Which of the following payloads would correctly test if the first character is 'p' by causing a 5-second delay?
⚠ Common exam trap
The trap here is using database-specific functions from the wrong DBMS, such as SLEEP() or WAITFOR, instead of PostgreSQL's pg_sleep.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
'; SELECT CASE WHEN (SELECT SUBSTRING(current_database(),1,1)='p') THEN pg_sleep(5) ELSE pg_sleep(0) END; --
Time-based blind SQL injection on PostgreSQL requires using the pg_sleep function. The payload uses a CASE statement to conditionally execute pg_sleep(5) if the first character of the current database name is 'p'. This causes a 5-second delay, allowing the attacker to infer the character. The other options use syntax from MySQL or SQL Server, which are incompatible with PostgreSQL.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
'; SELECT CASE WHEN (SELECT SUBSTRING(current_database(),1,1)='p') THEN BENCHMARK(5000000,MD5(1)) ELSE 0 END; --
Why it's wrong here
This payload uses BENCHMARK(), which is a MySQL function for time-based injections. PostgreSQL does not have BENCHMARK. The correct function is pg_sleep. Using MySQL syntax on PostgreSQL will result in an error and no delay, so it will not work in this scenario.
- ✗
'; SELECT CASE WHEN (SELECT SUBSTRING(database(),1,1)='p') THEN SLEEP(5) ELSE SLEEP(0) END; --
Why it's wrong here
This payload uses SLEEP(), which is a MySQL function, not PostgreSQL. PostgreSQL uses pg_sleep(). Additionally, the function database() is MySQL; PostgreSQL uses current_database(). Therefore, this payload will fail on a PostgreSQL backend. It is incorrect for the specified database.
- ✓
'; SELECT CASE WHEN (SELECT SUBSTRING(current_database(),1,1)='p') THEN pg_sleep(5) ELSE pg_sleep(0) END; --
Why this is correct
This payload uses PostgreSQL's pg_sleep function within a CASE statement. It checks if the first character of the current database name is 'p'. If true, it sleeps for 5 seconds; otherwise, it sleeps for 0 seconds. This is a standard time-based blind SQL injection technique for PostgreSQL, and it will cause a measurable delay if the condition is met.
- ✗
'; IF (SELECT SUBSTRING(current_database(),1,1)='p') WAITFOR DELAY '0:0:5' --
Why it's wrong here
This payload uses WAITFOR DELAY, which is specific to Microsoft SQL Server, not PostgreSQL. The scenario specifies a PostgreSQL backend, so this payload will cause a syntax error and will not execute. It is a common mistake to use SQL Server syntax on a PostgreSQL database.
About these practice questions
This PEN-200 question is part of Courseiva's 285-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official OffSec exam blueprint
This PEN-200 practice question is part of Courseiva's free OffSec certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PEN-200 exam.