SQL Injection CEH Practice Questions (Page 5)

Questions 21–25

1. 21application · medium · select all that apply

   A penetration tester has confirmed a SQL injection vulnerability in a web application. The tester wants to exploit it to extract data from the database. Which of the following are valid exploitation techniques? (Select all that apply.)

   • AUNION-based injection to combine the original query with a malicious query.
   • BOut-of-band injection to exfiltrate data via DNS or HTTP requests.
   • CUsing a WAF to block the injection and prevent data extraction.
   • DTime-based blind injection to infer data based on response delays.
   • EBoolean-based blind injection to infer data character by character.
   Check answers Discussion Select an answer first
2. 22expert · hard

   A security architect is designing a defense-in-depth strategy for a web application that handles sensitive data. The application has a legacy module that cannot be refactored to use parameterized queries in the short term. The architect wants to reduce the risk of SQL injection while the refactoring is completed. Which combination of controls provides the most effective interim mitigation?

   • AUse a database proxy that rewrites queries to use parameters.
   • BImplement a strict input blacklist and block all requests containing SQL keywords.
   • CDeploy a Web Application Firewall (WAF) with SQL injection rules and restrict the database account to least-privilege.
   • DDisable all database error messages and use input validation.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A development team is implementing a new feature that accepts user input for a database query. The team wants to ensure the application is resistant to SQL injection. Which combination of practices provides the strongest defense?

   • AUse parameterized queries and apply least-privilege database accounts.
   • BUse input validation and a Web Application Firewall.
   • CUse a blacklist of SQL keywords and block suspicious requests.
   • DUse stored procedures and escape all input.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary cause of a SQL injection vulnerability in a web application?

   • AThe application uses an outdated database management system.
   • BThe application stores passwords in plain text in the database.
   • CThe application runs on a shared hosting server with other web applications.
   • DThe application concatenates user-supplied input directly into SQL queries without proper sanitization or parameterization.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A penetration tester is assessing a web application that uses a PostgreSQL database. The tester has found a SQL injection in a numeric parameter. The application does not display any data from the query, but it does return different HTTP status codes (200 vs 404) based on the query result. Which type of SQL injection is this, and what is the most efficient way to exploit it?

   • AUnion-based injection; use UNION SELECT to retrieve data directly.
   • BTime-based blind injection; use SLEEP to extract data.
   • CError-based injection; use error messages to extract data.
   • DBoolean-based blind injection; use sqlmap with --technique=B to automate extraction.
   Reveal Solution Discussion Select an answer first