nerdexam
EC-Council

312-50V13 · Question #473

This type of injection attack does not show any error message. It is difficult to exploit as it returns information when the application is given SQL payloads that elicit a true or false response…

The correct answer is D. Blind SQL injection. This describes a Blind SQL injection, where attackers infer data by observing subtle true/false responses or timing differences without direct error messages or results.

Submitted by anjalisingh· Mar 6, 2026SQL Injection

Question

This type of injection attack does not show any error message. It is difficult to exploit as it returns information when the application is given SQL payloads that elicit a true or false response from the server. By observing the response, an attacker can extract sensitive information. What type of attack is this?

Options

  • ATime-based SQL injection
  • BUnion SQL injection
  • CError-based SQL injection
  • DBlind SQL injection

How the community answered

(31 responses)
  • A
    3% (1)
  • B
    3% (1)
  • D
    94% (29)

Why each option

This describes a Blind SQL injection, where attackers infer data by observing subtle true/false responses or timing differences without direct error messages or results.

ATime-based SQL injection

Time-based SQL injection is a specific type of blind SQL injection that relies solely on time delays for inferring data, whereas blind SQL injection can also use boolean responses.

BUnion SQL injection

Union SQL injection combines the results of multiple SELECT statements, displaying data directly in the application's response, which contradicts the 'does not show any error message' premise.

CError-based SQL injection

Error-based SQL injection leverages explicit database error messages to reveal information, which is directly contrary to the attack description that states 'does not show any error message'.

DBlind SQL injectionCorrect

Blind SQL injection does not display direct query results or error messages, forcing an attacker to infer data by observing the application's responses to carefully crafted payloads that elicit a true/false condition or a time delay.

Concept tested: Blind SQL injection characteristics

Source: https://learn.microsoft.com/en-us/azure/security/fundamentals/sql-injection

Topics

#Blind SQL injection#SQL injection types#database attacks

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V13 Practice