312-50 Question 352
Single answer▪ SQL Injection ConceptsDuring an authorized web application assessment, you test a login form that sends a POST request with the parameters username and password to a backend SQL database. When you enter a single quote (') in the username field, the application returns a database syntax error. The application does not display query results directly after login attempts, but the HTTP response changes from "Invalid credentials" to "Welcome back" when you submit certain crafted input. Which payload is the most appropriate initial test to confirm a Boolean-based SQL injection in the username field while minimizing the risk of damaging data?
- A
' OR 1=1 --
- B
'; DROP TABLE users; --
- C
' UNION SELECT username, password FROM users --
- D
' OR '1'='2' --
Show answer and explanation
Correct answer: A
Explanation
The scenario describes behavior consistent with Boolean-based SQL injection: the application does not return database records directly, but the tester can infer success or failure from differences in application responses. A single quote causing a SQL syntax error strongly suggests insufficient input sanitization or unsafe dynamic SQL construction. In such a case, a low-impact logical test such as ' OR 1=1 -- is the most appropriate initial validation payload because it checks whether the tester can manipulate the WHERE clause to alter authentication behavior.
By contrast, destructive statements such as DROP TABLE are inappropriate in an ethical hacking engagement unless explicitly authorized and required in a controlled environment. UNION-based extraction is more suitable when output is reflected and column structure is understood. A complete Boolean-based test often compares a true condition like ' OR 1=1 -- with a false condition such as ' OR '1'='2' -- to observe differing responses. This approach aligns with secure coding guidance from OWASP, which identifies SQL injection as a major risk and recommends parameterized queries, prepared statements, allow-list input validation, and least-privilege database accounts as key defenses.
- A. Correct.
Correct. This is a classic Boolean-based SQL injection test payload. If the application builds a query such as SELECT * FROM users WHERE username = '' AND password = '', then injecting ' OR 1=1 -- can cause the WHERE clause to evaluate as true and comment out the rest of the query, potentially changing the application's response from a failed login message to a successful one. It is commonly used as an initial validation step because it tests whether user input can alter query logic without attempting destructive actions.
- B. Incorrect.
Incorrect. This payload attempts a destructive stacked query to delete a table. It is not an appropriate initial validation step in a professional assessment because it can damage data and may not even work if the backend or database driver does not allow stacked queries. Ethical testing standards require minimizing impact and avoiding unnecessary harm.
- C. Incorrect.
Incorrect. UNION-based payloads are used to extract data when the application reflects query results and when the attacker knows or can infer the correct number and types of columns. In this scenario, the application does not directly display query results from the login process, so UNION SELECT is not the most appropriate first test. It is also more intrusive than a simple Boolean condition check.
- D. Incorrect.
Incorrect. This payload is useful as a false-condition comparison in Boolean-based testing because '1'='2' evaluates to false, but by itself it would not normally confirm injection in the same way as a true condition that changes behavior to "Welcome back." A tester may use both true and false conditions to compare responses, but if selecting one initial payload to confirm the issue, the true-condition payload is the more direct choice.