312-50 Question 356
Single answer▪ Types of SQL InjectionDuring an authorized web application assessment, you test a product search feature that sends requests such as /search?id=15. When you submit /search?id=15 AND 1=1, the normal product page is returned. When you submit /search?id=15 AND 1=2, the page changes to 'No products found.' The application does not display database errors, and UNION-based attempts are blocked by input filtering. You still need to determine whether the parameter is injectable and continue extracting data without relying on visible error messages. Which type of SQL injection technique is most applicable in this scenario?
- A
Boolean-based blind SQL injection
- B
Error-based SQL injection
- C
UNION-based SQL injection
- D
Out-of-band SQL injection
Show answer and explanation
Correct answer: A
Explanation
This scenario describes a classic blind SQL injection condition where the tester cannot see database errors or directly retrieve query results, but can observe different application behavior based on injected true/false conditions. That is the hallmark of Boolean-based blind SQL injection. In practice, an assessor would use conditional expressions to infer data one character or bit at a time, often automating the process with approved tools during an authorized engagement. This aligns with common guidance from OWASP on SQL Injection, which distinguishes in-band techniques such as UNION-based and error-based SQLi from inferential or blind techniques such as Boolean-based and time-based SQLi. Because the page content changes when the condition changes, Boolean-based blind SQL injection is the best answer. Error-based is ruled out because no errors are displayed, UNION-based is ruled out because it is filtered, and out-of-band is unnecessary because a direct inference channel already exists.
- A. Correct.
Correct. The application's response changes based on whether a Boolean condition is true or false, which is the defining behavior of Boolean-based blind SQL injection. Because no database errors are shown and the tester can infer application behavior from content differences such as 'normal page' versus 'No products found,' this is the most appropriate technique to confirm injection and extract data bit by bit.
- B. Incorrect.
Incorrect. Error-based SQL injection depends on the database or application returning verbose error messages that reveal details such as query structure, table names, or DBMS-specific output. In this scenario, the application does not display database errors, so error-based techniques are not the best fit.
- C. Incorrect.
Incorrect. UNION-based SQL injection is used when the attacker can append a UNION SELECT statement and have the results rendered in the application's response. The scenario explicitly states that UNION-based attempts are blocked by input filtering, so this is not the most applicable option.
- D. Incorrect.
Incorrect. Out-of-band SQL injection is typically used when in-band methods are unavailable and the database can trigger external interactions such as DNS or HTTP callbacks. While it can be useful in some restricted environments, the scenario already provides a clear true/false response channel, making Boolean-based blind SQL injection the most applicable technique.