SQL Injection Evasion: Char Encoding vs. White Space
An ethical hacker is hired to evaluate the defenses of an organization's database system which is known to employ a signature-based IDS. The hacker knows that some SQL Injection evasion techniques may allow him to bypass the system's signatures. During the operation, he successfully retrieved a list of usernames from the database without triggering an alarm by employing an advanced evasion technique. Which of the following could he have used?
Community Votes
67% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests knowledge of specific SQL injection evasion techniques against signature-based detection, where the common trap is confusing general obfuscation (like white space) with payload transformation (char encoding).
This page explains how char encoding bypasses signature-based IDS by converting SQL keywords into non-standard ASCII values that evade pattern matching while remaining valid to the database engine.
Many candidates choose C (white space manipulation) because it is a common evasion technique, but it often fails against modern signature-based IDS that are configured to ignore whitespace variations in SQL commands.
Community Discussion (8 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option A is correct because theCHAR function allows an attacker to construct SQL strings using decimal or hexadecimal ASCII codes (e.g., CHAR(111,114) for 'or'). This transforms the literal keyword 'OR' into a sequence of numbers, effectively bypassing signature-based Intrusion Detection Systems (IDS) that look for specific text patterns like 'OR 1=1'. The database engine parses these codes back into characters, executing the attack successfully.Why the Other Options Are Wrong
Option B is incorrect because sophisticated boolean matches like 'OR john'=‘john’ still contain recognizable SQL syntax and keywords that many IDS signatures can detect; they do not fundamentally change the character representation like encoding does. Option C is incorrect because while whitespace manipulation can bypass simple filters, signature-based IDS typically have rules to handle standard spacing variations, making it less reliable than full payload encoding. Option D is incorrect because URL encoding is primarily used for web traffic transmission and is often decoded by the web server before reaching the SQL engine, whereas CHAR encoding operates directly within the SQL query structure to bypass the IDS inspection of the payload content itself.Community Comment Notes
Community feedback was split between A and C. Users supporting A cited official study materials (Module 15) stating that char encoding converts values to pass through SQL engine parsing. Users supporting C argued for whitespace manipulation as a bypass method. One commenter noted that 'B - boolean based SQL... is part of pretty much any decent IDS,' reinforcing why B is weak. Another user pointed out that 'A is the second in the list in thais page,' referencing the source material's ordering.Exam Strategy
When facing questions about 'signature-based IDS' evasion, prioritize techniques that alter the character set or encoding of the payload (like CHAR(), CONCAT(), or hex encoding) over structural changes like whitespace or comments, as signatures rely heavily on pattern matching of specific keywords.
Frequently Asked Questions
Why is white space manipulation (C) not the best answer?
Signature-based IDS often ignore whitespace variations. Char encoding alters the actual bytes of the command, making it harder for static signatures to match.
Does URL encoding (D) work for SQL injection evasion?
URL encoding is usually handled by the web server or WAF before the request reaches the backend SQL parser, making it less effective for direct DB-level evasion compared to CHAR().