312-50 Question 359
Single answer▪ SQL Injection MethodologyDuring an authorized web application assessment, you identify a product search feature that sends requests like GET /search?q=laptop. When you submit laptop', the application returns a database syntax error. When you submit laptop' ORDER BY 3--, the page loads normally, but laptop' ORDER BY 4-- causes an error. The original search results are displayed in a three-column HTML table. You want to confirm whether UNION-based SQL injection is feasible and determine the next logical payload to test. Which option is the best choice?
- A
Submit
laptop' UNION SELECT NULL,NULL,NULL--to verify that a UNION query with three columns is accepted - B
Submit
laptop' UNION SELECT @@version--because version disclosure is the fastest way to confirm injection - C
Submit
laptop'; DROP TABLE products--because destructive payloads prove exploitability conclusively - D
Submit
laptop' AND 1=2--because a false condition is the required next step after ORDER BY enumeration
Show answer and explanation
Correct answer: A
Explanation
This question tests practical SQL injection methodology rather than memorization. In a typical UNION-based SQL injection workflow, a tester first confirms that input affects the SQL statement, then determines the number of columns returned by the original query, often using ORDER BY or incremental UNION SELECT tests. Here, ORDER BY 3 succeeding and ORDER BY 4 failing strongly suggests that the query has three columns. The appropriate next step is to attempt a UNION SELECT with exactly three expressions. Using NULL placeholders is a widely accepted best practice because it minimizes type mismatch issues across database platforms. After confirming that the UNION works, the tester would normally identify which columns are reflected in the response by replacing NULL values with markers such as strings or numbers, then move to controlled data extraction. This aligns with common guidance in secure testing references such as the OWASP Web Security Testing Guide and OWASP SQL Injection Prevention materials, which emphasize structured, non-destructive validation and careful matching of UNION query column counts.
- A. Correct.
Correct. The ORDER BY testing indicates that the underlying query likely returns three columns, because ORDER BY 3 succeeds and ORDER BY 4 fails. In UNION-based SQL injection methodology, the next practical step is to test a UNION SELECT with the same number of columns as the original query. Using NULL values is a standard and safe approach because NULL is often type-compatible across different column data types, helping the tester confirm whether UNION-based injection is possible before attempting to identify reflected columns or extract data.
- B. Incorrect.
Incorrect. Although retrieving the database version can be a useful later step, this payload is not the best next choice because it likely supplies the wrong number of columns. A UNION query must generally match the number of columns in the original SELECT. Since the ORDER BY results suggest three columns, using only one expression such as @@version would typically fail unless padded to the correct column count. The misconception is jumping to data extraction before validating UNION structure.
- C. Incorrect.
Incorrect. This is both unethical and outside the scope of proper CEH methodology in an authorized assessment unless explicitly approved for destructive testing, which is rarely the case. CEH emphasizes safe validation of vulnerabilities, not damaging production data. The misconception is assuming that proving exploitability requires destructive actions; in practice, non-destructive verification is the correct approach.
- D. Incorrect.
Incorrect. A boolean-based payload such as AND 1=2 can help validate SQL injection behavior in some cases, especially for blind or conditional testing, but it is not the most logical next step given the evidence already gathered. The tester has already confirmed error-based behavior and inferred the column count via ORDER BY. At this stage, the methodology points toward testing UNION compatibility with the proper number of columns.