Which payload types are commonly used to test injection flaws?

• A. tautologies, union-based, time-based
• B. comments, whitespace, anchor
• C. HTML tags only
• D. None of the above

Answer: (A)

Common injection testing uses payload families designed to reveal how a query is formed and whether user input can alter its meaning. The three main types you’ll encounter are tautologies, union-based, and time-based payloads.

Tautologies change the logic of a condition to always be true, which can let an attacker bypass authentication or other checks. For example, injecting something like OR 1=1 turns a restrictive WHERE clause into a condition that’s always true, exposing whether the input is being unsafely incorporated into the query.

Union-based payloads try to combine a second query with the original one, aiming to pull data from other parts of the database. If the application returns data from a different table, that indicates a vulnerability and helps reveal what data might be accessible.

Time-based payloads rely on the database’s response time. By injecting a condition that causes a delay when true (for instance, a sleep function), you can infer whether the injection is executed based on how long the page takes to respond, even without visible data being returned.

Comments, whitespace, and anchors can be useful obfuscation techniques but are not the primary categories of payloads used to test injection flaws. HTML tags alone relate to HTML or XSS issues rather than SQL or similar injections. None of the above is incorrect because these three payload types are indeed the common ones used to test injection flaws.