312-50 Question 118
Single answerTypesDuring a web application assessment, an ethical hacker wants to determine whether a login form is vulnerable to SQL injection without using destructive payloads. The tester first submits a normal username/password pair and observes a generic authentication failure. Next, the tester submits the username value 'admin' and then 'admin'' while keeping the password field unchanged. The application returns a standard login failure for the first attempt but produces a database syntax error for the second. Which type of SQL injection testing technique is the tester primarily using to identify the vulnerability?
- A
Error-based SQL injection testing
- B
Time-based blind SQL injection testing
- C
Boolean-based blind SQL injection testing
- D
Out-of-band SQL injection testing
Show answer and explanation
Correct answer: A
Explanation
This scenario tests recognition of SQL injection types in a realistic assessment workflow. When a tester appends a single quote and the application returns a database syntax error, that strongly indicates unsanitized input is being inserted into a SQL statement. In CEH-style classification, this is error-based SQL injection, a subtype of in-band SQL injection because the tester receives confirmation through the application's normal response channel. By contrast, boolean-based blind and time-based blind SQL injection are used when errors are suppressed and the tester must infer vulnerability from behavioral differences or timing changes. Out-of-band techniques are used when neither direct content nor timing is sufficient and the database can trigger external interactions. This aligns with common secure coding guidance from OWASP, which recommends parameterized queries and suppression of verbose database errors in production to prevent exactly this kind of disclosure.
- A. Correct.
Correct. The tester is intentionally supplying input that causes malformed SQL syntax, and the application responds with a visible database error. This is characteristic of error-based SQL injection testing, where the presence of detailed DBMS error messages helps confirm that user input is being embedded unsafely into SQL queries.
- B. Incorrect.
Incorrect. Time-based blind SQL injection relies on payloads that cause measurable delays, such as database sleep functions, when a condition is true. In this scenario, the tester is not measuring response timing and instead is observing a direct syntax error message.
- C. Incorrect.
Incorrect. Boolean-based blind SQL injection depends on comparing differences in application behavior for true versus false conditions, usually without explicit database errors. Here, the key indicator is a visible SQL syntax error, so this is not primarily a blind technique.
- D. Incorrect.
Incorrect. Out-of-band SQL injection uses alternate channels such as DNS or HTTP callbacks to exfiltrate data or confirm exploitation when direct responses are unavailable. The scenario involves immediate in-band error feedback from the application, not an external communication channel.