Which types of SQL injection attacks exist? (Choose two)

The correct answer is A. Time-based blind SQL injection B. Stored SQL injection. Time-based blind SQL injection (A) is a real attack technique where an attacker infers database information by injecting payloads that cause conditional time delays (e.g., IF(1=1, SLEEP(5), 0)), observing response timing to extract data without direct output. Stored SQL…

Question

Options

ATime-based blind SQL injection
BStored SQL injection
CDNS-based SQL injection
DSession-based SQL injection

How the community answered

(46 responses)

A
76% (35)
C
17% (8)
D
7% (3)

Explanation

Time-based blind SQL injection (A) is a real attack technique where an attacker infers database information by injecting payloads that cause conditional time delays (e.g., IF(1=1, SLEEP(5), 0)), observing response timing to extract data without direct output. Stored SQL injection (B) - also called persistent or second-order injection - occurs when malicious SQL is saved to the database (e.g., in a user profile field) and later executed when retrieved, making it particularly dangerous because the attack payload is decoupled from the initial input.

C (DNS-based) is not a recognized SQL injection category - DNS exfiltration can be a data exfiltration technique used alongside SQLi, but it's not a type of SQL injection itself. D (Session-based) is fabricated entirely; sessions are a web authentication concept, not an SQL injection variant.

Memory tip: Think of the two main axes of SQL injection - how data is retrieved (blind/time-based vs. error-based vs. union-based) and when the payload executes (in-band/immediate vs. stored/deferred). Any answer that doesn't fit these axes is a distractor.

Community Discussion

No community discussion yet for this question.

Full GWAPT Practice