Extracting Database Info via Time Delays in SQL Injection

312-50v12 By islever Editorial Last updated

SQL Injection

Short answer

A Utilize a blind injection technique that uses time delays or error signatures to extract information

Question

During an attempt to perform an SQL injection attack, a certified ethical hacker is focusing on the identification of database engine type by generating an ODBC error. The ethical hacker, after injecting various payloads, finds that the web application returns a standard, generic error message that does not reveal any detailed database information. Which of the following techniques would the hacker consider next to obtain useful information about the underlying database?
  1. Utilize a blind injection technique that uses time delays or error signatures to extract information Correct Answer
  2. Try to insert a string value where a number is expected in the input field
  3. Attempt to compromise the system through OS-level command shell execution
  4. Use the UNION operator to combine the result sets of two or more SELECT statements

Key Takeaways

Tests the pivot from explicit to blind SQL injection when the target application hides detailed database engine information behind generic error pages.

When generic error messages prevent database fingerprinting, ethical hackers use blind injection techniques with time delays to extract data. This page explains how to proceed when ODBC errors are suppressed.

Common mistake: Learners often choose UNION-based injection (D) or OS command execution (C), failing to realize that UNION requires a visible result set and command execution is a different attack vector entirely.

Expert Analysis

Why the Answer Is Correct

When an attacker cannot determine the database type because the application suppresses specific ODBC errors, they must switch to Blind SQL Injection. By injecting payloads that induce time delays (e.g., WAITFOR DELAY in SQL Server or SLEEP in MySQL), the hacker can infer information based on the response time, effectively bypassing the lack of visible error messages.

Why the Other Options Are Wrong

Option B is a basic syntax check that likely won't work if the input is sanitized or if the field type mismatch doesn't trigger a useful error. Option C targets the operating system, not the database engine identification phase, and usually requires prior exploitation. Option D (UNION) requires the application to return visible data rows; since the app returns generic errors, UNION cannot be used to extract information directly.

Community Comment Notes

The community consensus strongly supports option A. As one user noted, "A - seems the most plausible one" because other options either require existing shell access or rely on visible output that isn't present. Another comment references official CEH study material confirming this progression.

Exam Strategy

Always check for error visibility first. If errors are generic or hidden, immediately consider Blind SQL Injection techniques involving time delays or boolean logic rather than trying to force UNION or OS commands.

Frequently Asked Questions

Why can't I use UNION even if I know the DB type?

UNION requires the application to display the results of the query. If it only shows generic errors, you cannot see the combined result sets.

Is time delay injection always reliable?

It is reliable for extracting data bit-by-bit but is slower than error-based injection. It works well when the network latency is consistent.

More 312-50v12 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. insaniunt 👍 3 Answered A
    A. Utilize a blind injection technique that uses time delays or error signatures to extract information
  2. LordXander 👍 1 Answered A
    B - would be filtered out C - well...if you already have shell capabilities, why bother with database errors D - same for B A - seems the most plausible one
  3. dobarb 👍 1
    A is correct. CEH page 2223-2224

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Comprehensive Network Scanning Sequence

S-grade

NetBIOS Enumeration on IPv6 Networks

S-grade

Ethical Hacker Liability and Organizational Risk Acceptance

S-grade

Least Likely Social Engineering Method Based on Footprinting Data

S-grade

← Back to 312-50v12 Study Guide