A library PDF feature never echoes command output, but carefully timed requests show consistent delays that track injected sleep-style behavior under RoE. What detection concept applies?
Select an answer to reveal the explanation.
Short Explanation
Sometimes the house does not shout back — it just takes longer to answer the door. Blind command injection can show up as timing or out-of-band clues instead of printed output. Controlled delays under RoE are a detection concept, not a free-for-all.
Full Explanation
Time-based or blind command-injection detection uses timing side channels when command output is not echoed. A library PDF feature that never returns shell output, yet shows consistent delays tracking injected sleep-style behavior under RoE, illustrates that concept: impact can still be inferred carefully without verbose errors. Civic testers should use minimal, authorized timing proofs rather than noisy destructive commands.
Delays are not “only error-based SQLi” territory—timing applies to command injection too. Certificate transparency poisoning and BGP hijack confirmation are unrelated network/PKI themes.
Exam caveat: keep timing tests throttled and RoE-approved; do not run destructive payloads to “be sure.” CPTS blind detection themes include boolean/time SQLi and time-based OS command injection.
Operational check: document timing differentials with conservative intervals, confirm the sink is a shell/OS command path, remediate with safe APIs, and retest that crafted inputs no longer induce controllable delays on the library service. Timing proofs belong in controlled windows; brief library IR that brief latency spikes during the test were intentional, authorized measurements.