312-50 Question 354
Single answer▪ Types of SQL InjectionDuring a sanctioned web application assessment, you test a product search feature that issues a request such as /search?id=25. When you submit id=25 AND 1=1, the page returns normal results. When you submit id=25 AND 1=2, the page returns a generic 'No products found' message. The application does not display database errors, and UNION-based payloads are blocked by input filtering. You need to identify the most likely SQL injection type being demonstrated based on the application's observable behavior. Which type of SQL injection is this?
- A
Error-based SQL injection
- B
Union-based SQL injection
- C
Boolean-based blind SQL injection
- D
Out-of-band SQL injection
Show answer and explanation
Correct answer: C
Explanation
This scenario describes boolean-based blind SQL injection, a subtype of inferential SQL injection. The key indicator is that the tester cannot see SQL errors or direct query output, but can still infer whether injected conditions evaluate to true or false by observing differences in application behavior. In CEH-style assessments, recognizing the distinction between in-band SQL injection types such as error-based and UNION-based, inferential types such as boolean-based and time-based blind, and out-of-band techniques is essential. Industry guidance such as the OWASP Web Security Testing Guide and OWASP SQL Injection Prevention Cheat Sheet emphasizes that blind SQL injection is identified through response behavior, timing, or side channels when direct output is suppressed. Proper mitigation includes parameterized queries, server-side input validation, least-privilege database accounts, and avoiding dynamic SQL construction with untrusted input.
- A. Incorrect.
Error-based SQL injection is incorrect because the scenario explicitly states that the application does not display database errors. Error-based techniques rely on verbose database error messages to reveal information about the query structure, database type, or data content.
- B. Incorrect.
Union-based SQL injection is incorrect because the scenario notes that UNION-based payloads are blocked by input filtering. In addition, the observed behavior is based on differences in the application's response to true and false conditions rather than combining results from a second SELECT statement.
- C. Correct.
Boolean-based blind SQL injection is correct because the tester infers the presence of injection from differences in the application's normal content when a condition is true versus false. The payloads AND 1=1 and AND 1=2 are classic examples used to determine whether the backend query logic can be influenced even when no errors are shown and no direct data is returned.
- D. Incorrect.
Out-of-band SQL injection is incorrect because there is no indication that the tester is receiving data through an alternate channel such as DNS or HTTP callbacks from the database server. Out-of-band methods are typically used when in-band and inferential techniques are not practical and require supporting database functionality and network egress.