Extracting Database Info via Time Delays in SQL Injection
During an attempt to perform an SQL injection attack, a certified ethical hacker is focusing on the identification of database engine type by generating an ODBC error. The ethical hacker, after injecting various payloads, finds that the web application returns a standard, generic error message that does not reveal any detailed database information. Which of the following techniques would the hacker consider next to obtain useful information about the underlying database?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests the pivot from explicit to blind SQL injection when the target application hides detailed database engine information behind generic error pages.
When generic error messages prevent database fingerprinting, ethical hackers use blind injection techniques with time delays to extract data. This page explains how to proceed when ODBC errors are suppressed.
Learners often choose UNION-based injection (D) or OS command execution (C), failing to realize that UNION requires a visible result set and command execution is a different attack vector entirely.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
When an attacker cannot determine the database type because the application suppresses specific ODBC errors, they must switch to Blind SQL Injection. By injecting payloads that induce time delays (e.g., WAITFOR DELAY in SQL Server or SLEEP in MySQL), the hacker can infer information based on the response time, effectively bypassing the lack of visible error messages.Why the Other Options Are Wrong
Option B is a basic syntax check that likely won't work if the input is sanitized or if the field type mismatch doesn't trigger a useful error. Option C targets the operating system, not the database engine identification phase, and usually requires prior exploitation. Option D (UNION) requires the application to return visible data rows; since the app returns generic errors, UNION cannot be used to extract information directly.Community Comment Notes
The community consensus strongly supports option A. As one user noted, "A - seems the most plausible one" because other options either require existing shell access or rely on visible output that isn't present. Another comment references official CEH study material confirming this progression.Exam Strategy
Always check for error visibility first. If errors are generic or hidden, immediately consider Blind SQL Injection techniques involving time delays or boolean logic rather than trying to force UNION or OS commands.
Frequently Asked Questions
Why can't I use UNION even if I know the DB type?
UNION requires the application to display the results of the query. If it only shows generic errors, you cannot see the combined result sets.
Is time delay injection always reliable?
It is reliable for extracting data bit-by-bit but is slower than error-based injection. It works well when the network latency is consistent.