Time-Based and Boolean-Based SQL Injection Techniques

312-50v13 By islever Editorial Last updated

SQL Injection

Short answer

D Jane Smith uses Time-based and Boolean-based SQL injection to determine true or false results without direct data output.

Question

Ethical hacker Jane Smith is attempting to perform an SQL injection attack. She wants to test the response time of a true or false response and wants to use a second command to determine whether the database will return true or false results for user IDs. Which two SQL injection types would give her the results she is looking for?
  1. Out of band and boolean-based
  2. Union-based and error-based
  3. Time-based and union-based
  4. Time-based and boolean-based Correct Answer

Key Takeaways

The question tests the ability to distinguish blind SQLi techniques based on observable feedback mechanisms like time delays and true/false conditions.

This page explains how ethical hackers use Time-Based and Boolean-based SQL injection to infer database truth values through response delays or UI changes.

Common mistake: Candidates often confuse Union-based SQLi with blind techniques, overlooking that Union requires visible data output rather than just true/false inference.

Expert Analysis

Why the Answer Is Correct

Correct answer: D — The scenario describes a blind SQL injection context where the attacker cannot see direct query results but must infer truthfulness. Time-based injection relies on measuring server response latency (e.g., via SLEEP commands) to deduce if a condition is true. Boolean-based (or inferential) injection relies on observing differences in application behavior or content between true and false responses. Together, these are the two primary methods for extracting data when no direct error messages or result sets are returned.

Why the Other Options Are Wrong

Union-based injection (Options B and C) requires the target application to display combined results from multiple SELECT statements, which contradicts the "true or false" inference constraint. Error-based injection (Option B) relies on database error messages being displayed to the user, which is not mentioned as a mechanism here. Out-of-band injection (Option A) uses secondary channels like DNS or HTTP requests to exfiltrate data, which does not fit the description of testing response time or boolean logic within the main request.

Community Comment Notes

Community consensus strongly supports Option D, with users noting that "time-based" corresponds to the response time test and "boolean-based" corresponds to the true/false selection. Comments highlight that these two techniques are specifically designed for blind scenarios where direct output is unavailable.

Exam Strategy

When analyzing SQL injection questions, look for keywords indicating 'blind' access (no direct output). If the attacker measures time, it's Time-Based. If they observe content/behavior changes, it's Boolean-Based. Avoid Union/Error unless explicit data display or errors are mentioned.

Frequently Asked Questions

Why isn't Union-based SQL injection correct here?

Union-based requires the application to display combined query results. The scenario specifies inferring true/false outcomes, which implies a blind injection context where direct data is not shown.

What is the difference between Boolean and Time-based SQLi?

Boolean-based relies on observing differences in application responses (like text changes) for true/false conditions. Time-based relies on measuring the delay in server response times to infer truth.

More 312-50v13 FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. KiranYS 👍 2 Answered D
    Jane Smith can use Time-Based Blind SQL Injection and Boolean-Based Blind SQL Injection to achieve her goal.
  2. MHafizC 👍 2 Answered D
    The explanations are more towards time-based (response time) and boolean (selection).
  3. getaseadsss 👍 2 Answered D
    Is time-basd and boolean. correct answer is D
  4. Dogeo 👍 1 Answered D
    Both time-based and boolean-based injection techniques are useful for determining true or false conditions, making them the correct combination for Jane Smith's goal.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Agent-Based vs Network-Based Vulnerability Scanners

S-grade

Network Sniffing Techniques for Penetration Testing

S-grade

File-less Malware Bypassing Application Whitelisting

S-grade

SQL Injection Bypass in Login Forms

S-grade

← Back to 312-50v13 Study Guide