nerdexam
EC-Council

312-50V12 · Question #291

This type of injection attack does not show any error message. It is difficult to exploit as it returns information when the application is given SQL payloads that elicit a true or false response from

The correct answer is D. Blind SQL injection. The question describes an SQL injection attack that does not produce error messages, but instead allows an attacker to extract information by observing true or false responses from the server to crafted payloads.

Submitted by sofia.br· Mar 4, 2026Web Application Hacking

Question

This type of injection attack does not show any error message. It is difficult to exploit as it returns information when the application is given SQL payloads that elicit a true or false response from the server. By observing the response, an attacker can extract sensitive information. What type of attack is this?

Options

  • AUnion SQL injection
  • BError-based SQL injection
  • CTime-based SQL injection
  • DBlind SQL injection

How the community answered

(54 responses)
  • A
    2% (1)
  • B
    6% (3)
  • C
    4% (2)
  • D
    89% (48)

Why each option

The question describes an SQL injection attack that does not produce error messages, but instead allows an attacker to extract information by observing true or false responses from the server to crafted payloads.

AUnion SQL injection

Union SQL injection relies on using the UNION operator to combine the results of an injected query with the legitimate query, directly returning data to the attacker, which contradicts the scenario's lack of direct output.

BError-based SQL injection

Error-based SQL injection relies on the database displaying specific error messages that contain sensitive information about the database structure or data, directly contradicting the statement that 'does not show any error message'.

CTime-based SQL injection

Time-based SQL injection is a type of blind SQL injection that infers information by observing delays in the server's response time, which is different from the true/false response mechanism described in the question, although it is also a blind technique.

DBlind SQL injectionCorrect

Blind SQL injection is an attack where the attacker infers information by observing the application's response to injected SQL queries, without the database directly outputting data or error messages. The scenario perfectly describes boolean-based blind SQL injection, a specific technique where true/false conditions elicited by SQL payloads are used to extract information iteratively.

Concept tested: Blind SQL injection characteristics and types

Source: https://owasp.org/www-community/attacks/Blind_SQL_Injection

Topics

#blind SQL injection#SQL injection#web application vulnerabilities

Community Discussion

No community discussion yet for this question.

Full 312-50V12 Practice