Certified Ethical Hacker (CEH v13) — Question 17

Ethical hacker Jane Smith is attempting to perform an SQL injection attack. She wants to test the response time of a true or false response and wants to use a second command to determine whether the database will return true or false results for user IDs.
Which two SQL injection types would give her the results she is looking for?

Answer options

• A. Out of band and boolean-based
• B. Union-based and error-based
• C. Time-based and union-based
• D. Time-based and boolean-based

Correct answer: D

Explanation

The correct answer is D, as time-based and boolean-based SQL injections are specifically designed to determine the truth value of conditions based on response times. Out of band and union-based injections do not focus on timing responses or simple true/false evaluations, making them unsuitable for Jane's objective.