SQL Injection CEH Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which type of SQL injection relies on the same communication channel to both inject the malicious SQL and receive the results?

   • ABoolean-based SQL injection
   • BIn-band SQL injection
   • COut-of-band SQL injection
   • DBlind SQL injection
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A penetration tester is exploiting a SQL injection vulnerability in a search feature. The tester wants to extract data from a different table in the same database. The original query is: SELECT title, description FROM products WHERE category = '$cat'. Which technique should the tester use to retrieve data from the 'users' table?

   • A'; DROP TABLE users; --
   • B' OR 1=1 --
   • CUNION SELECT username, password FROM users --
   • D' AND 1=2 UNION SELECT * FROM users --
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security tester is evaluating a web application that displays user profile information. The tester suspects SQL injection in the 'username' parameter. When the tester submits a payload that causes a DNS lookup to an external domain, the tester observes the DNS query in the logs. Which type of SQL injection is this, and what is the primary advantage of this technique?

   • AIn-band SQL injection; it uses the same channel to send and receive data.
   • BBlind SQL injection; it is faster than boolean-based techniques.
   • CError-based SQL injection; it relies on database error messages.
   • DOut-of-band SQL injection; it allows data extraction even when the application does not display results or return errors.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security analyst is testing a web application's search feature. The analyst submits a single quote (') and receives a database error. The analyst then submits ' AND 1=1 -- and the page returns results, but ' AND 1=2 -- returns no results. Which type of SQL injection is this, and what is the most appropriate next step to confirm the vulnerability?

   • AOut-of-band SQL injection; use DNS lookup to confirm the vulnerability.
   • BIn-band SQL injection; use UNION SELECT to extract data directly.
   • CError-based SQL injection; use the database error to extract table names.
   • DBlind SQL injection; use a time-based payload such as '; WAITFOR DELAY '0:0:5' -- to confirm the vulnerability.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A penetration tester is assessing a legacy web application that uses string concatenation to build SQL queries. The tester wants to confirm a suspected SQL injection vulnerability in the login form with minimal noise and without causing database errors that could alert the security team. Which approach should the tester use first?

   • AUse a boolean-based payload like ' OR '1'='1 in the password field to see if the login succeeds without valid credentials.
   • BIntercept the request with Burp Suite and change the HTTP method from POST to GET to see if the parameter is reflected in the URL.
   • CRun sqlmap with the --level=5 and --risk=3 flags against the login form to automatically detect and exploit any injection point.
   • DSubmit a single quote (') in the username field and observe the application's response for an error message or abnormal behavior.
   Reveal Solution Discussion Select an answer first