How Should a Tester Confirm Blind SQL Injection?

PT0-002 By islever Editorial Last updated

Short answer

B '; IF (1=1) WAITFOR DELAY '0:0:10'--

Question

During an assessment of a web application, a penetration tester would like to test the application for blind SQL injection. Which of the following techniques should the penetration tester perform next?
  1. 1' ORDER BY 1--+
  2. '; IF (1=1) WAITFOR DELAY '0:0:10'-- Correct Answer
  3. xyz' AND '1' = '1
  4. xyz' AND (SELECT CASE WHEN (1=1) THEN 1/0 ELSE 'a' END)='a)

Key Takeaways

The exam tests whether you can distinguish time-based blind SQL injection, boolean-based blind SQLi, and error-based SQLi; the common trap is choosing a boolean or error-based option when blind conditions mean the tester cannot rely on visible output.

When testing for blind SQL injection, time-based payloads such as '; IF (1=1) WAITFOR DELAY '0:0:10'-- provide observable response delays that work even when the application reveals no query results or error messages. The CompTIA PT0-002 community strongly favors option B (83%), explaining why time-delay is the definitive blind SQLi technique.

Common mistake: Option D (conditional division by zero) is the most common wrong answer because it seems to create a detectable SQL error, but blind SQL injection assumes errors and query output are hidden, making a time-delay like WAITFOR DELAY the more reliable blind technique.

Expert Analysis

Why the Answer Is Correct

Option B uses time-based blind SQL injection: '; IF (1=1) WAITFOR DELAY '0:0:10'-- tells the database to wait 10 seconds if the conditional evaluates to true. This creates a measurable time difference in the HTTP response, which is exactly what blind SQL injection needs when no error messages or query rows are returned. Community commenter [1] states it directly: 'The only way to see results from a blind injection will be time delays; you have no other way of measuring success.' This makes B the clear choice for the 'next' step.

Why the Other Options Are Wrong

Option A (1' ORDER BY 1--+) is used to discover the number of columns, not to prove blind injection; it works by causing syntax or logic changes and is more common with UNION-based injection. Option C (xyz' AND '1' = '1) is a boolean-based blind payload, but it relies on comparing page content between true and false conditions, which is not always reliable and was not listed as the preferred next step. Option D (xyz' AND (SELECT CASE WHEN (1=1) THEN 1/0 ELSE 'a' END)='a)) is an error-based conditional that depends on the application displaying database errors; in a blind scenario errors are usually suppressed. Therefore, only the time-delay technique in B works universally in true blind SQL injection conditions.

Community Comment Notes

Community votes show 83% support for B and only 17% for D, and the most-upvoted comment (like=2) explains that time delays are the only measurable result in blind SQLi. Another comment (like=2) simply agrees with B, while one commenter notes the test answer is D; however, D is an error-based technique and is, at best, a conditional error-based blind payload that still needs application error responses to be meaningful. The consensus in the thread and in penetration-testing practice is that B is the strongest answer because it does not depend on any visible SQL output or database error rendering.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

On exam day, if a question says 'blind SQL injection,' immediately ask whether the tester can see query results, errors, or page differences. If not, select the payload that uses a database delay function such as WAITFOR DELAY (MSSQL) or SLEEP (MySQL) because time is always visible through response latency.

Community Votes

B
83%
D
17%

83% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. Snagggggin 👍 2 Answered B
    The only way to see results from a blind injection will be time delays, you have no other way of measuring success. B is the only possible answer.
  2. zemijan 👍 2 Answered B
    B. '; IF (1=1) WAITFOR DELAY '0:0:10'--
  3. Alex818119 👍 1 Answered B
    Bing AI says the answer is B: When it comes to testing for blind SQL injection, a common method involves using time-based techniques to infer the results of queries. This is because the application may not return visible error messages or results directly to the tester. The most suitable choice for a time-based blind SQL injection technique would be: B. '; IF (1=1) WAITFOR DELAY '0:0:10'-- This payload uses the WAITFOR DELAY command, which causes the database to pause for 10 seconds if the condition (1=1) is true. If the application becomes unresponsive for 10 seconds, it indicates that the SQL injection was successful.
  4. Learner213 👍 1 Answered D
    The test answer is D

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Which Post-Report Activity Prevents CISO Disputing Finding Validity?

S-grade

How should penetration testers prioritize findings in a report?

S-grade

Which agreement did a pen tester breach by requesting a CVE without authorization?

S-grade

Which Tool Best Detects Vulnerabilities on a Database Server?

S-grade

← Back to PT0-002 Study Guide