Time-Based and Boolean-Based SQL Injection Techniques
Ethical hacker Jane Smith is attempting to perform an SQL injection attack. She wants to test the response time of a true or false response and wants to use a second command to determine whether the database will return true or false results for user IDs. Which two SQL injection types would give her the results she is looking for?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests the ability to distinguish blind SQLi techniques based on observable feedback mechanisms like time delays and true/false conditions.
This page explains how ethical hackers use Time-Based and Boolean-based SQL injection to infer database truth values through response delays or UI changes.
Candidates often confuse Union-based SQLi with blind techniques, overlooking that Union requires visible data output rather than just true/false inference.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Correct answer: D — The scenario describes a blind SQL injection context where the attacker cannot see direct query results but must infer truthfulness. Time-based injection relies on measuring server response latency (e.g., via SLEEP commands) to deduce if a condition is true. Boolean-based (or inferential) injection relies on observing differences in application behavior or content between true and false responses. Together, these are the two primary methods for extracting data when no direct error messages or result sets are returned.Why the Other Options Are Wrong
Union-based injection (Options B and C) requires the target application to display combined results from multiple SELECT statements, which contradicts the "true or false" inference constraint. Error-based injection (Option B) relies on database error messages being displayed to the user, which is not mentioned as a mechanism here. Out-of-band injection (Option A) uses secondary channels like DNS or HTTP requests to exfiltrate data, which does not fit the description of testing response time or boolean logic within the main request.Community Comment Notes
Community consensus strongly supports Option D, with users noting that "time-based" corresponds to the response time test and "boolean-based" corresponds to the true/false selection. Comments highlight that these two techniques are specifically designed for blind scenarios where direct output is unavailable.Exam Strategy
When analyzing SQL injection questions, look for keywords indicating 'blind' access (no direct output). If the attacker measures time, it's Time-Based. If they observe content/behavior changes, it's Boolean-Based. Avoid Union/Error unless explicit data display or errors are mentioned.
Frequently Asked Questions
Why isn't Union-based SQL injection correct here?
Union-based requires the application to display combined query results. The scenario specifies inferring true/false outcomes, which implies a blind injection context where direct data is not shown.
What is the difference between Boolean and Time-based SQLi?
Boolean-based relies on observing differences in application responses (like text changes) for true/false conditions. Time-based relies on measuring the delay in server response times to infer truth.