312-50 Question 120
Single answerTypesDuring a web application assessment, an ethical hacker identifies a login form that submits the username and password to a backend SQL database. The tester enters the payload ' OR '1'='1' -- into the username field and successfully bypasses authentication. To document the finding accurately and recommend the most appropriate remediation, which type of SQL injection best describes this attack?
- A
Error-based SQL injection
- B
Boolean-based blind SQL injection
- C
Union-based SQL injection
- D
In-band SQL injection
Show answer and explanation
Correct answer: D
Explanation
This scenario describes a classic SQL injection used for login bypass by manipulating the WHERE clause of an authentication query. Among the listed choices, the best classification is in-band SQL injection because the attacker injects the payload and immediately observes the result through the same web application channel. While some training materials further divide SQL injection into in-band, inferential (blind), and out-of-band categories, authentication-bypass payloads like ' OR '1'='1' -- are commonly treated as in-band when the result is directly visible. Recommended remediation includes parameterized queries or prepared statements, strict server-side input handling, least-privilege database accounts, and secure error handling. This aligns with OWASP guidance on SQL Injection Prevention, which recommends prepared statements as the primary defense and avoiding dynamic query construction with unsanitized user input.
- A. Incorrect.
Error-based SQL injection is incorrect because this attack does not rely on database error messages being returned to the application. Error-based SQL injection uses crafted input to trigger verbose SQL errors that reveal database structure or query details. In this scenario, the attacker bypasses authentication directly without using errors to extract information.
- B. Incorrect.
Boolean-based blind SQL injection is incorrect because blind SQL injection is used when the application does not visibly return query results, and the attacker infers true or false conditions from differences in application behavior. Although the payload contains a boolean expression, the key outcome here is direct authentication bypass through immediate application response, not inference-based extraction in a blind context.
- C. Incorrect.
Union-based SQL injection is incorrect because UNION-based attacks use the SQL UNION operator to combine results from one query with another, typically to extract data from additional tables or columns. The payload shown does not use UNION and is instead altering the WHERE clause logic to make the authentication condition evaluate as true.
- D. Correct.
In-band SQL injection is correct because the attacker uses the same communication channel to deliver the payload and receive the application's response. The example is a classic authentication-bypass SQL injection where input such as ' OR '1'='1' -- modifies the logic of the backend query. In-band SQL injection is a broader category that includes techniques where the attacker can interact directly with the vulnerable application and observe the results immediately.