SQL Injection Evasion: Char Encoding vs. White Space

312-50v12 By islever Editorial Last updated

SQL Injection

Short answer

A Utilizing the char encoding function to convert hexadecimal and decimal values into characters that pass-through SQL engine parsing.

Question

An ethical hacker is hired to evaluate the defenses of an organization's database system which is known to employ a signature-based IDS. The hacker knows that some SQL Injection evasion techniques may allow him to bypass the system's signatures. During the operation, he successfully retrieved a list of usernames from the database without triggering an alarm by employing an advanced evasion technique. Which of the following could he have used?
  1. Utilizing the char encoding function to convert hexadecimal and decimal values into characters that pass-through SQL engine parsing Correct Answer
  2. Implementing sophisticated matches such as "OR john' = 'john'" in place of classical matches like "OR 1=1"
  3. Manipulating white spaces in SQL queries to bypass signature detection
  4. Using the URL encoding method to replace characters with their ASCII codes in hexadecimal form

Key Takeaways

The question tests knowledge of specific SQL injection evasion techniques against signature-based detection, where the common trap is confusing general obfuscation (like white space) with payload transformation (char encoding).

This page explains how char encoding bypasses signature-based IDS by converting SQL keywords into non-standard ASCII values that evade pattern matching while remaining valid to the database engine.

Common mistake: Many candidates choose C (white space manipulation) because it is a common evasion technique, but it often fails against modern signature-based IDS that are configured to ignore whitespace variations in SQL commands.

Expert Analysis

Why the Answer Is Correct

Option A is correct because the CHAR function allows an attacker to construct SQL strings using decimal or hexadecimal ASCII codes (e.g., CHAR(111,114) for 'or'). This transforms the literal keyword 'OR' into a sequence of numbers, effectively bypassing signature-based Intrusion Detection Systems (IDS) that look for specific text patterns like 'OR 1=1'. The database engine parses these codes back into characters, executing the attack successfully.

Why the Other Options Are Wrong

Option B is incorrect because sophisticated boolean matches like 'OR john'=‘john’ still contain recognizable SQL syntax and keywords that many IDS signatures can detect; they do not fundamentally change the character representation like encoding does. Option C is incorrect because while whitespace manipulation can bypass simple filters, signature-based IDS typically have rules to handle standard spacing variations, making it less reliable than full payload encoding. Option D is incorrect because URL encoding is primarily used for web traffic transmission and is often decoded by the web server before reaching the SQL engine, whereas CHAR encoding operates directly within the SQL query structure to bypass the IDS inspection of the payload content itself.

Community Comment Notes

Community feedback was split between A and C. Users supporting A cited official study materials (Module 15) stating that char encoding converts values to pass through SQL engine parsing. Users supporting C argued for whitespace manipulation as a bypass method. One commenter noted that 'B - boolean based SQL... is part of pretty much any decent IDS,' reinforcing why B is weak. Another user pointed out that 'A is the second in the list in thais page,' referencing the source material's ordering.

Exam Strategy

When facing questions about 'signature-based IDS' evasion, prioritize techniques that alter the character set or encoding of the payload (like CHAR(), CONCAT(), or hex encoding) over structural changes like whitespace or comments, as signatures rely heavily on pattern matching of specific keywords.

Frequently Asked Questions

Why is white space manipulation (C) not the best answer?

Signature-based IDS often ignore whitespace variations. Char encoding alters the actual bytes of the command, making it harder for static signatures to match.

Does URL encoding (D) work for SQL injection evasion?

URL encoding is usually handled by the web server or WAF before the request reaches the backend SQL parser, making it less effective for direct DB-level evasion compared to CHAR().

More 312-50v12 FAQ →

Community Votes

A
67%
C
33%

67% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. Nopez 👍 3 Answered C
    C. Manipulating white spaces in SQL queries to bypass signature detection
  2. insaniunt 👍 2 Answered A
    Char Encoding: an attacker can encode a common injection variable present in the input string to avoid detection in the signature of network security measures. This char() function converts hexadecimal and decimal values into characters that can easily pass through SQL engine parsing. The char() function can be used for SQL injection into MySQL without double quotes - Module 15 Page 2324
  3. przemyslaw1 👍 2 Answered A
    A. Utilizing the char encoding...
  4. DIINESSH 👍 1 Answered B
    ChatGPT says : B. Implementing sophisticated matches such as "OR ‘john’=’john’” allows the hacker to bypass signature-based detection systems that may only be looking for classical SQL injection patterns like "OR 1=1". By using more complex and varied syntax, the hacker can evade detection.
  5. LordXander 👍 1
    I would definitely say A. B - boolean based SQL, is part of pretty much any decent IDS C - plausible but personally, I saw that usage of custom characters might get it bypassed for a WAF. D - is like A but you need something that can be read by SQL engine
Show 3 more comments
  1. ba1dd4b 👍 1 Answered A
    A, B, C and D. All of them. I think some questions have multiple answers. All choices are listed in Module 15, page 2322. A is the second in the list in thais page.
  2. qtygbapjpesdayazko 👍 1 Answered A
    Utilizing the char encoding function to convert hexadecimal and decimal values into characters
  3. xbsumz 👍 1
    Im not certain about this ethical hacking concept

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Comprehensive Network Scanning Sequence

S-grade

NetBIOS Enumeration on IPv6 Networks

S-grade

Ethical Hacker Liability and Organizational Risk Acceptance

S-grade

Least Likely Social Engineering Method Based on Footprinting Data

S-grade

← Back to 312-50v12 Study Guide