In error-based SQL injection, how does an attacker typically extract information from the database?

By causing the database to generate error messages that include data in the error text

By sending DNS queries to an external server controlled by the attacker

By using UNION queries to combine results with the original query

By observing differences in response times for true and false conditions

What is the purpose of using URL encoding in SQL injection payloads to bypass filters?

To speed up the database query execution

To avoid detection by encoding special characters that the WAF might block

To make the payload compatible with all database types

A penetration tester is assessing a search feature that returns product names from a database. The tester suspects SQL injection and wants to extract the 'username' and 'password' columns from the 'users' table. The tester has already confirmed that the original query returns two columns. Which payload should the tester use to retrieve the credentials?

' UNION SELECT username, password FROM users --

Why is the principle of least privilege important in mitigating SQL injection impact?

It prevents the database from being accessed by any application

It limits the damage an attacker can do if the application is compromised

It ensures that the application uses only read-only queries

It encrypts all data in the database

A security engineer is testing a web application for SQL injection. The application returns the same HTTP 200 page for all inputs, but the response time varies slightly. Which testing technique is most appropriate to confirm the vulnerability?

Submit a boolean condition like AND 1=1 vs AND 1=2 and compare response content.

Submit a time-based payload like SLEEP(5) and measure the response time.

Submit a single quote and look for a database error message.

Use a UNION-based payload to extract data directly.

EC-CouncilWeb Application Hacking and Security

Domain 2Objective 1

Advanced SQL Injection (SQLi) WAHS Practice Questions (Page 4)

Part of the Injection Attacks domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~17–29 in this domain), expect 6–10 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

9concepts

Questions 16–20

16foundation · easy
In error-based SQL injection, how does an attacker typically extract information from the database?
Select an answer first
17foundation · easy
What is the purpose of using URL encoding in SQL injection payloads to bypass filters?
Select an answer first
18application · medium
A penetration tester is assessing a search feature that returns product names from a database. The tester suspects SQL injection and wants to extract the 'username' and 'password' columns from the 'users' table. The tester has already confirmed that the original query returns two columns. Which payload should the tester use to retrieve the credentials?
Select an answer first
19foundation · easy
Why is the principle of least privilege important in mitigating SQL injection impact?
Select an answer first
20application · medium
A security engineer is testing a web application for SQL injection. The application returns the same HTTP 200 page for all inputs, but the response time varies slightly. Which testing technique is most appropriate to confirm the vulnerability?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.