312-50V10 · Question #272
What is the main difference between a "Normal" SQL Injection and a "Blind" SQL Injection vulnerability?
The correct answer is D. The vulnerable application does not display errors with information about the injection results to. Blind SQL Injection differs from normal SQL Injection in that the application returns no visible error messages or query data to the attacker, forcing inference of results from application behavior.
Question
What is the main difference between a "Normal" SQL Injection and a "Blind" SQL Injection vulnerability?
Options
- AThe request to the web server is not visible to the administrator of the vulnerable application.
- BThe attack is called "Blind" because, although the application properly filters user input, it is still
- CThe successful attack does not show an error message to the administrator of the affected
- DThe vulnerable application does not display errors with information about the injection results to
How the community answered
(49 responses)- A2% (1)
- B2% (1)
- C4% (2)
- D92% (45)
Why each option
Blind SQL Injection differs from normal SQL Injection in that the application returns no visible error messages or query data to the attacker, forcing inference of results from application behavior.
Whether the administrator can see the HTTP request to the server is unrelated to the blind vs. normal SQL injection distinction - both attack types produce the same server-side traffic visibility.
Blind SQL Injection does not imply the application properly filters input - the injection still succeeds; the 'blind' aspect refers only to the absence of visible output returned to the attacker.
Whether the administrator sees error messages is not the defining characteristic - the key distinction is that the attacker, not the administrator, receives no direct feedback about the injection results.
In a Blind SQL Injection scenario, the vulnerable application suppresses or does not return database error messages or query results directly to the attacker. The attacker must infer information indirectly - either through boolean-based responses (true/false page differences) or time-based delays - rather than reading data directly from an error or output field.
Concept tested: Distinguishing blind vs. normal SQL injection output behavior
Source: https://owasp.org/www-community/attacks/Blind_SQL_Injection
Topics
Community Discussion
No community discussion yet for this question.