312-50 Question 355
Single answer▪ Types of SQL InjectionDuring an authorized web application assessment, you find that the product search page sends requests like GET /search?q=laptop. When you submit laptop' AND 1=1--, the page returns normal results, but laptop' AND 1=2-- returns no results. The application does not display database error messages, and when you try UNION SELECT, the response remains unchanged. You need to identify the most likely SQL injection type demonstrated by this behavior.
- A
Boolean-based blind SQL injection
- B
Error-based SQL injection
- C
Union-based SQL injection
- D
Out-of-band SQL injection
Show answer and explanation
Correct answer: A
Explanation
The key indicator is that the application's response changes when a boolean expression is manipulated (1=1 versus 1=2), even though no errors are displayed and no direct data is returned. That pattern maps to boolean-based blind SQL injection, a subtype of inferential SQL injection. In practice, testers use this technique when the application suppresses SQL errors and does not reflect query output. This aligns with common guidance from OWASP on SQL Injection, which distinguishes error-based, union-based, and blind techniques based on observable application behavior. Best practice for mitigation includes parameterized queries/prepared statements, server-side input validation, least-privilege database accounts, and avoiding detailed database error disclosure.
- A. Correct.
Correct. The application behavior changes based on whether the injected condition evaluates to true or false, while no database errors are shown. This is the classic pattern of boolean-based blind SQL injection, where the tester infers backend query results from differences in the application's visible response.
- B. Incorrect.
Incorrect. Error-based SQL injection relies on the application returning database error messages or verbose exceptions that reveal query structure or database details. In this scenario, the application does not display database errors, so error-based SQL injection is not the best classification.
- C. Incorrect.
Incorrect. Union-based SQL injection depends on successfully appending a
UNION SELECTstatement and observing returned data in the application's response. The scenario specifically notes that attempts withUNION SELECTdo not alter the response, making this option inconsistent with the observed behavior. - D. Incorrect.
Incorrect. Out-of-band SQL injection is typically used when the attacker cannot retrieve data through normal responses and instead relies on external channels such as DNS or HTTP callbacks from the database server. Nothing in the scenario suggests external interaction or asynchronous exfiltration.