Exam 312-50v13 Topic 1 Question 501 Discussion

The behavior described matches Boolean-based blind SQL injection, which is represented here as Boolean Exploitation. In this technique, the tester injects conditions that evaluate to TRUE or FALSE and then infers the backend query behavior by observing differences in the application's response-such as returning normal content versus returning an empty page-without relying on explicit database error messages or time delays.
The scenario's key indicators are:
The injected payloads include conditional logic like AND 1=2, which is a classic always-false test.
When a true condition is used, the portal returns the expected claim details; when a false condition is used, it returns "no results." The tester repeats these true/false tests specifically "without error messages or delays," which rules out error- based and time-based approaches and confirms the "blind" inference method.
Why the other options don't fit:
UNION SQL Injection (A) relies on combining a malicious UNION SELECT with the original query to extract additional rows/columns directly into the response. The scenario is not extracting unioned data; it is observing response differences from boolean conditions.
Error-based SQL Injection (B) depends on triggering database errors and reading error output. The scenario explicitly notes no error messages are involved.
Time-based Blind SQL Injection (C) infers truth values by forcing delays (e.g., SLEEP()), which is explicitly not occurring here.
Therefore, the technique is best identified as D. Boolean Exploitation (Boolean-based blind SQL injection).