A web application does not display database query results, but its responses change depending on whether a condition is true. Which injection type may be relevant, and what does the attacker use to learn information?

### What a good answer covers - Identify blind injection as the relevant type. - Explain that direct query results are not visible. - State that the attacker uses behavior or response differences to infer information. - Distinguish inference from receiving results directly through an in-band channel. ### Terms - **Blind injection**: injection where information is inferred from application behavior rather than directly displayed. - **SQL**: Structured Query Language, used to interact with relational databases. - **Inference**: reaching a conclusion from observable clues rather than direct access to the result. ### Remember When results are hidden but behavior varies, think of blind injection.