312-50V12 · Question #291
This type of injection attack does not show any error message. It is difficult to exploit as it returns information when the application is given SQL payloads that elicit a true or false response from
The correct answer is D. Blind SQL injection. The question describes an SQL injection attack that does not produce error messages, but instead allows an attacker to extract information by observing true or false responses from the server to crafted payloads.
Question
Options
- AUnion SQL injection
- BError-based SQL injection
- CTime-based SQL injection
- DBlind SQL injection
How the community answered
(54 responses)- A2% (1)
- B6% (3)
- C4% (2)
- D89% (48)
Why each option
The question describes an SQL injection attack that does not produce error messages, but instead allows an attacker to extract information by observing true or false responses from the server to crafted payloads.
Union SQL injection relies on using the UNION operator to combine the results of an injected query with the legitimate query, directly returning data to the attacker, which contradicts the scenario's lack of direct output.
Error-based SQL injection relies on the database displaying specific error messages that contain sensitive information about the database structure or data, directly contradicting the statement that 'does not show any error message'.
Time-based SQL injection is a type of blind SQL injection that infers information by observing delays in the server's response time, which is different from the true/false response mechanism described in the question, although it is also a blind technique.
Blind SQL injection is an attack where the attacker infers information by observing the application's response to injected SQL queries, without the database directly outputting data or error messages. The scenario perfectly describes boolean-based blind SQL injection, a specific technique where true/false conditions elicited by SQL payloads are used to extract information iteratively.
Concept tested: Blind SQL injection characteristics and types
Source: https://owasp.org/www-community/attacks/Blind_SQL_Injection
Topics
Community Discussion
No community discussion yet for this question.