312-50 Question 357
Single answer▪ SQL Injection MethodologyDuring an authorized web application assessment, you identify a product search parameter: /search.php?q=laptop. The application returns SQL syntax errors when a single quote is added, confirming the input reaches the backend query. Your goal is to verify whether the parameter is vulnerable to UNION-based SQL injection and determine how many columns are returned by the original query without causing unnecessary disruption. Which action is the most appropriate next step?
- A
Append an ORDER BY clause with increasing column numbers, such as ' ORDER BY 1--, then ' ORDER BY 2--, until the application returns an error
- B
Submit ' OR 1=1-- to force the application to return all records, proving the parameter is injectable
- C
Use stacked queries to create a temporary table and compare response timing across requests
- D
Inject a blind payload such as ' AND ASCII(SUBSTRING(DB_NAME(),1,1))>77-- and infer the number of columns from true/false responses
Show answer and explanation
Correct answer: A
Explanation
When a tester confirms that input reaches a backend SQL query and receives database error feedback, the next step in a UNION-based SQL injection methodology is usually to determine the number of columns in the original SELECT statement. Two common methods are ORDER BY enumeration and UNION SELECT with varying numbers of NULL values. ORDER BY is often preferred early because it is simple and relatively controlled: the tester increases the column index until the database returns an error, indicating the requested sort position exceeds the number of columns in the result set. After determining the column count, the tester can identify which columns accept displayed or compatible data types for UNION exploitation. This approach is consistent with widely accepted SQL injection testing guidance such as the OWASP Web Security Testing Guide and PortSwigger Web Security Academy materials on SQL injection, which describe identifying query structure before attempting data extraction.
- A. Correct.
Correct. In UNION-based SQL injection methodology, a common and low-impact way to determine the number of columns in the original SELECT statement is to test ORDER BY with incrementing column indexes until the database reports an out-of-range error. Once the highest valid index is identified, the tester knows how many columns are present and can craft a matching UNION SELECT payload. This aligns with standard SQLi enumeration methodology used in authorized testing.
- B. Incorrect.
Incorrect. Although ' OR 1=1-- may demonstrate that input is not properly sanitized, it is not the best next step for UNION-based enumeration. It can also cause the application to return a large dataset, making it noisier and more disruptive than necessary. In CEH-style methodology, determining the column count is a more precise next step when preparing for UNION-based injection.
- C. Incorrect.
Incorrect. Stacked queries are not consistently supported across database engines or application drivers, and creating tables is unnecessarily invasive for initial verification. This goes beyond the minimally invasive approach expected during a professional assessment and is not the standard next step for identifying UNION compatibility.
- D. Incorrect.
Incorrect. This is a blind SQL injection technique used when content-based or error-based feedback is limited. In this scenario, the application already returns SQL errors, making ORDER BY or UNION NULL testing more appropriate for determining column count. Blind inference does not directly and efficiently reveal the number of columns needed for a UNION-based attack.