Ethical hacker jane Smith is attempting to perform an SQL injection attach. She wants to test the response time of a true or false response and wants…

The question describes two distinct types of blind SQL injection. The first technique, testing the response time based on a true or false condition, is the definition of Time-based blind SQL injection. The attacker instructs the database to pause (e.g., using SLEEP() or WAITFOR DELAY) if a specific condition is true, inferring the result from the delayed response. The second technique, determining true or false results for user IDs by observing the application's response, is Boolean-based blind SQL injection. The attacker appends a condition and observes whether the resulting page content changes, indicating a true or false outcome.

A. Out of band and boolean-based: Out-of-band SQL injection exfiltrates data through a separate network channel (e.g., DNS or HTTP requests), which is not based on response time.

B. Time-based and union-based: Union-based SQL injection uses the UNION operator to append query results directly to the application's response, it does not infer data based on true/false conditions.

C. union-based and error-based: Error-based injection extracts data by forcing the database to generate error messages containing the desired information, which is different from the methods described.

1. Pessina

F.

& Boix

E. G. (2021). SQLi: A Survey of Attack Techniques and a Study of the Effectiveness of a Popular Black-Box Web Application Scanner. KTH Royal Institute of Technology

School of Electrical Engineering and Computer Science. In Section 2.1.2

"Blind SQL Injection

" the paper defines the two sub-techniques: "The first one is called boolean-based blind SQLi... The second technique is called time-based blind SQLi... the attacker can ask the database to wait for a certain amount of time before responding." (p. 4).

2. Johns

M. (2005). Lecture Notes: SQL Injection. In CS-2005-10

Security Engineering. Columbia University. This courseware describes Blind SQL Injection

stating

"If the condition is true

the server will wait for 10 seconds... This is called a time-based attack." It also explains

"If the condition is true

the page will be displayed normally... This is called a boolean-based attack." (p. 10).

3. Kar

D.

Panigrahi

S.

& Sundararajan

S. (2016). SQLiScanner: Detecting SQL Injection Vulnerabilities. 2016 International Conference on Communication and Signal Processing (ICCSP). In Section II-B

"Classification of SQL Injection Attack

" the paper classifies Blind SQL Injection into Boolean based and Time based categories

describing their exact mechanisms as mentioned in the question. DOI: 10.1109/ICCSP.2016.7754290.