312-50 Question 327
Single answer▪ Perform Injection/Input Validation AttacksDuring an authorized web application assessment, you test a product search feature that sends requests like /search?category=tools&sort=price. The application builds the backend SQL query dynamically based on the sort parameter. When you intercept the request and change sort to price DESC,(SELECT CASE WHEN SUBSTRING(@@version,1,1)='1' THEN 1 ELSE 1/0 END), the page intermittently returns a database error instead of normal results. The application does not display query results from injected subqueries directly. Based on this behavior, which attack technique is the most appropriate for extracting data in this scenario?
- A
Boolean-based blind SQL injection, by observing differences in normal page content for true and false conditions
- B
Error-based SQL injection, by deliberately triggering database errors that reveal information through application responses
- C
Union-based SQL injection, by appending a UNION SELECT to display extracted data in the search results
- D
Command injection, by escaping from SQL context and executing operating system commands through the sort parameter
Show answer and explanation
Correct answer: B
Explanation
The key clue is that the sort parameter is concatenated into a dynamic SQL statement and that a crafted payload causes database errors visible in the application response. That strongly indicates error-based SQL injection rather than blind or UNION-based methods. In practice, dynamic construction of SQL fragments such as ORDER BY clauses is risky because parameterized queries do not safely handle arbitrary SQL identifiers or keywords unless developers apply strict allowlisting of accepted values such as fixed column names and sort directions. Best practices from sources such as the OWASP SQL Injection Prevention Cheat Sheet recommend parameterized queries where possible, combined with allowlist input validation for cases like sorting, table names, or column names that cannot be parameterized directly. Error handling should also avoid exposing verbose database errors to users, since those messages can aid attackers during exploitation.
- A. Incorrect.
This is not the best answer for the scenario given. Boolean-based blind SQL injection is useful when the application suppresses errors and the tester must infer true/false conditions from subtle changes in content, response length, or behavior. Here, the tester already observed that crafted input can cause explicit database errors, which provides a more direct error-based path.
- B. Correct.
Correct. The payload uses a conditional expression that intentionally causes a divide-by-zero error when the condition is false or true, depending on construction. Because the application returns a database error in response to injected SQL logic, this is characteristic of error-based SQL injection. In real assessments, testers may leverage database error messages or differential error behavior to infer data when direct output is unavailable.
- C. Incorrect.
This would be appropriate only if the application reflected query results from injected SELECT statements into the page and if the tester could align column counts and data types. The scenario explicitly states that the application does not display query results from injected subqueries directly, making UNION-based extraction less appropriate here.
- D. Incorrect.
This is incorrect because the observed behavior indicates SQL query manipulation, not operating system command execution. Command injection occurs when untrusted input is passed to shell or system calls, whereas this parameter is influencing an SQL ORDER BY/sort context. Confusing SQL injection with command injection is a common misconception.