SQL Injection CEH Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   During a web application test, a security analyst notices that injecting a single quote into a search parameter does not produce any error message, but the page content changes slightly when the input is true versus false. The application does not display database errors. Which type of SQL injection is most likely present?

   • AIn-band SQL injection (union-based)
   • BBlind SQL injection (boolean-based)
   • COut-of-band SQL injection (DNS exfiltration)
   • DError-based SQL injection
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A penetration tester is evaluating a web application that uses a Microsoft SQL Server backend. The tester suspects SQL injection but the application does not return any database error messages. The tester wants to use an out-of-band technique to extract data. Which sqlmap option should be used?

   • A--time-sec=5
   • B--string='valid'
   • C--technique=BEU
   • D--dns-domain=attacker.com
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A web developer is reviewing code for a search feature that uses a SQL query built by concatenating a user-supplied search term. The developer wants to test whether the application is vulnerable to SQL injection without causing damage to the database. Which manual testing technique is most appropriate?

   • ASubmit a payload that performs a UNION SELECT to extract data immediately.
   • BSubmit a single quote (') and observe if the application returns a database error.
   • CSubmit a payload that deletes a table to confirm the vulnerability.
   • DUse a fuzzer to send random strings and look for crashes.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security auditor is reviewing a Java web application that uses JDBC to query a database. The auditor finds that user input is concatenated directly into SQL statements. The team wants to refactor the code to prevent SQL injection while minimizing changes. Which coding practice should the team adopt?

   • AUse a stored procedure that concatenates the input inside the database.
   • BUse Statement and manually escape single quotes in user input.
   • CUse PreparedStatement with parameter placeholders (?) and set the input as a parameter.
   • DUse a custom input validation function that removes all non-alphanumeric characters.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A penetration tester is assessing a web application that uses a search feature. The application returns results normally, but when the tester submits a single quote, the application returns a generic error. The tester then submits ' AND 1=1 -- and gets results, but ' AND 1=2 -- returns no results. The tester wants to extract data from the database. Which technique is most appropriate given the application's behavior?

   • AUse error-based injection to extract data from error messages.
   • BUse out-of-band injection to extract data via DNS.
   • CUse boolean-based blind injection to extract data character by character.
   • DUse UNION-based injection to extract data in a single request.
   Reveal Solution Discussion Select an answer first