nerdexam
EC-Council

312-50V10 · Question #272

What is the main difference between a "Normal" SQL Injection and a "Blind" SQL Injection vulnerability?

The correct answer is D. The vulnerable application does not display errors with information about the injection results to. Blind SQL Injection differs from normal SQL Injection in that the application returns no visible error messages or query data to the attacker, forcing inference of results from application behavior.

SQL Injection

Question

What is the main difference between a "Normal" SQL Injection and a "Blind" SQL Injection vulnerability?

Options

  • AThe request to the web server is not visible to the administrator of the vulnerable application.
  • BThe attack is called "Blind" because, although the application properly filters user input, it is still
  • CThe successful attack does not show an error message to the administrator of the affected
  • DThe vulnerable application does not display errors with information about the injection results to

How the community answered

(49 responses)
  • A
    2% (1)
  • B
    2% (1)
  • C
    4% (2)
  • D
    92% (45)

Why each option

Blind SQL Injection differs from normal SQL Injection in that the application returns no visible error messages or query data to the attacker, forcing inference of results from application behavior.

AThe request to the web server is not visible to the administrator of the vulnerable application.

Whether the administrator can see the HTTP request to the server is unrelated to the blind vs. normal SQL injection distinction - both attack types produce the same server-side traffic visibility.

BThe attack is called "Blind" because, although the application properly filters user input, it is still

Blind SQL Injection does not imply the application properly filters input - the injection still succeeds; the 'blind' aspect refers only to the absence of visible output returned to the attacker.

CThe successful attack does not show an error message to the administrator of the affected

Whether the administrator sees error messages is not the defining characteristic - the key distinction is that the attacker, not the administrator, receives no direct feedback about the injection results.

DThe vulnerable application does not display errors with information about the injection results toCorrect

In a Blind SQL Injection scenario, the vulnerable application suppresses or does not return database error messages or query results directly to the attacker. The attacker must infer information indirectly - either through boolean-based responses (true/false page differences) or time-based delays - rather than reading data directly from an error or output field.

Concept tested: Distinguishing blind vs. normal SQL injection output behavior

Source: https://owasp.org/www-community/attacks/Blind_SQL_Injection

Topics

#blind SQL injection#error-based injection#SQL injection types#information disclosure

Community Discussion

No community discussion yet for this question.

Full 312-50V10 Practice