312-50V12 · Question #249
While performing a security audit of a web application, an ethical hacker discovers a potential vulnerability. The application responds to logically incorrect queries with detailed error messages…
The correct answer is B. Error-based SQL Injection. An ethical hacker has identified a web application vulnerability where incorrect queries trigger detailed error messages revealing the database structure, and now seeks to exploit this. The question asks to identify the most suitable SQL Injection attack type for this scenario.
Question
Options
- AUNION SQL Injection
- BError-based SQL Injection
- CIn-band SQL Injection
- DBlind/Inferential SQL Injection
How the community answered
(44 responses)- A9% (4)
- B84% (37)
- C2% (1)
- D5% (2)
Why each option
An ethical hacker has identified a web application vulnerability where incorrect queries trigger detailed error messages revealing the database structure, and now seeks to exploit this. The question asks to identify the most suitable SQL Injection attack type for this scenario.
UNION SQL Injection involves using the UNION operator to combine results from injected queries with legitimate query results, which is not the primary method described by leveraging detailed error messages.
Error-based SQL Injection specifically leverages verbose error messages generated by the database server to extract information about the database's schema, version, or even data. Since the application provides 'detailed error messages that divulge the underlying database's structure,' this attack type is perfectly suited to exploit that specific vulnerability to gain more information or exfiltrate data.
In-band SQL Injection is a broad category where the attacker uses the same channel for injection and results; while Error-based SQL Injection is a form of in-band, 'Error-based' is the more specific and appropriate type given the detailed error message vulnerability.
Blind/Inferential SQL Injection is used when no direct output or error messages are returned, requiring the attacker to infer information based on boolean responses or time delays, which contradicts the scenario where detailed error messages are available.
Concept tested: SQL Injection attack types, Error-based SQL Injection
Source: https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05-SQL_Injection
Topics
Community Discussion
No community discussion yet for this question.