Which SQL injection technique relies on observing the application's response to infer information rather than retrieving data directly?

Which SQL injection technique relies on observing the application's response to infer information rather than retrieving data directly?

• A. Error-based SQLi
• B. Union-based SQLi
• C. Blind SQLi
• D. Time-based SQLi

Answer: (C)

Blind SQL injection relies on the attacker not receiving the database output directly in the web application's response. Instead, information is inferred by observing how the app behaves when crafted conditions are tested. This includes boolean-based blind, where you ask yes/no questions and look for differences in the page content or behavior to determine true or false, and time-based blind, where conditions trigger deliberate delays (for example, a sleep) and the extra response time reveals bits of data. Because nothing is revealed outright, you deduce values step by step rather than retrieving data in one shot.

Blind SQL injection relies on the attacker not receiving the database output directly in the web application's response. Instead, information is inferred by observing how the app behaves when crafted conditions are tested. This includes boolean-based blind, where you ask yes/no questions and look for differences in the page content or behavior to determine true or false, and time-based blind, where conditions trigger deliberate delays (for example, a sleep) and the extra response time reveals bits of data. Because nothing is revealed outright, you deduce values step by step rather than retrieving data in one shot.