How Should a Tester Confirm Blind SQL Injection?
During an assessment of a web application, a penetration tester would like to test the application for blind SQL injection. Which of the following techniques should the penetration tester perform next?
Community Votes
83% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests whether you can distinguish time-based blind SQL injection, boolean-based blind SQLi, and error-based SQLi; the common trap is choosing a boolean or error-based option when blind conditions mean the tester cannot rely on visible output.
When testing for blind SQL injection, time-based payloads such as '; IF (1=1) WAITFOR DELAY '0:0:10'-- provide observable response delays that work even when the application reveals no query results or error messages. The CompTIA PT0-002 community strongly favors option B (83%), explaining why time-delay is the definitive blind SQLi technique.
Option D (conditional division by zero) is the most common wrong answer because it seems to create a detectable SQL error, but blind SQL injection assumes errors and query output are hidden, making a time-delay like WAITFOR DELAY the more reliable blind technique.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option B uses time-based blind SQL injection:'; IF (1=1) WAITFOR DELAY '0:0:10'-- tells the database to wait 10 seconds if the conditional evaluates to true. This creates a measurable time difference in the HTTP response, which is exactly what blind SQL injection needs when no error messages or query rows are returned. Community commenter [1] states it directly: 'The only way to see results from a blind injection will be time delays; you have no other way of measuring success.' This makes B the clear choice for the 'next' step.Why the Other Options Are Wrong
Option A (1' ORDER BY 1--+) is used to discover the number of columns, not to prove blind injection; it works by causing syntax or logic changes and is more common with UNION-based injection. Option C (xyz' AND '1' = '1) is a boolean-based blind payload, but it relies on comparing page content between true and false conditions, which is not always reliable and was not listed as the preferred next step. Option D (xyz' AND (SELECT CASE WHEN (1=1) THEN 1/0 ELSE 'a' END)='a)) is an error-based conditional that depends on the application displaying database errors; in a blind scenario errors are usually suppressed. Therefore, only the time-delay technique in B works universally in true blind SQL injection conditions.Community Comment Notes
Community votes show 83% support for B and only 17% for D, and the most-upvoted comment (like=2) explains that time delays are the only measurable result in blind SQLi. Another comment (like=2) simply agrees with B, while one commenter notes the test answer is D; however, D is an error-based technique and is, at best, a conditional error-based blind payload that still needs application error responses to be meaningful. The consensus in the thread and in penetration-testing practice is that B is the strongest answer because it does not depend on any visible SQL output or database error rendering.Official Reference
Exam Strategy
On exam day, if a question says 'blind SQL injection,' immediately ask whether the tester can see query results, errors, or page differences. If not, select the payload that uses a database delay function such as WAITFOR DELAY (MSSQL) or SLEEP (MySQL) because time is always visible through response latency.