312-50 Question 351
Single answer▪ SQL Injection ConceptsDuring an authorized web application assessment, you test a product search feature that sends requests like GET /search?category=books&id=15. When you change the parameter to id=15', the application returns a database syntax error. A normal request returns quickly, but when you use id=15 AND SLEEP(5)--, the server response is delayed by about 5 seconds. The application does not display query results from injected UNION statements. Based on this behavior, which SQL injection technique is the MOST appropriate to reliably confirm and further exploit this issue?
- A
Use time-based blind SQL injection against the
idparameter to infer true/false conditions from response delays - B
Use UNION-based SQL injection because any syntax error confirms that the database will return arbitrary rows in the response
- C
Use DNS exfiltration immediately because a visible SQL error means out-of-band extraction is required
- D
Use command injection payloads in the
idparameter because delayed responses indicate OS command execution rather than SQL execution
Show answer and explanation
Correct answer: A
Explanation
This scenario is a classic case of blind SQL injection with a time-based confirmation path. The single quote causing a database syntax error indicates unsanitized input is likely being concatenated into a SQL statement. The SLEEP(5) delay provides stronger evidence that the database is evaluating injected SQL. Since UNION-based results are not reflected, the tester should use time-based blind techniques to ask yes/no questions, such as checking database version length or character values, and infer answers from response delays.
From a best-practice perspective, OWASP guidance on SQL Injection Prevention recommends parameterized queries/prepared statements, allow-list input validation where appropriate, and avoiding dynamic SQL construction with untrusted input. Error messages should also be suppressed from end users to reduce information leakage. In CEH-style assessments, recognizing the most effective exploitation path matters: when visible output is absent but time-delay payloads work, time-based blind SQL injection is typically the most reliable next step.
- A. Correct.
Correct. The scenario shows two important signs: a quote causes a SQL syntax error, and
SLEEP(5)introduces a measurable delay. That strongly indicates injectable SQL context and that the backend is processing the injected expression. Because UNION results are not reflected in the response, time-based blind SQL injection is the most appropriate technique to confirm the vulnerability and extract data by observing delays for true/false conditions. This is a standard blind SQLi approach when direct output is unavailable. - B. Incorrect.
Incorrect. A SQL syntax error suggests the input is reaching a query, but it does not mean UNION-based extraction will work. UNION-based SQL injection requires the application to return and render the query results in a visible part of the response, and the scenario explicitly states that injected UNION query results are not displayed. Choosing UNION here reflects the common misconception that any error-based behavior automatically enables visible data extraction.
- C. Incorrect.
Incorrect. DNS exfiltration or other out-of-band techniques can be useful in some environments, but they are not the most appropriate first choice in this scenario. The tester already has a working in-band signal: response timing via
SLEEP(5). Out-of-band methods are typically considered when direct and blind techniques are unavailable or unreliable, not simply because an error message is present. - D. Incorrect.
Incorrect. Delayed responses from a payload such as
SLEEP(5)in a SQL expression are consistent with database-level time-delay functions used in SQL injection testing, not evidence of operating system command injection. Command injection targets shell or OS command execution contexts and would require very different indicators and payloads. This option reflects confusion between application-layer injection classes.