PT0-002 Attacks and Exploits Practice Question
A tester is performing a web application test and discovers a parameter that seems to reflect input in the response. The tester attempts a reflected XSS payload but the application filters script tags. Which XSS variant should the tester try next?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reflected XSS with event handlers
If script tags are filtered, HTML event handlers like onerror can still execute JavaScript.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Blind XSS
Why it's wrong here
Blind XSS is a stored payload that executes in a context the tester cannot directly see, such as an admin panel or logging system. The vulnerability here is identified by the immediate reflection of injected input in the server's response, which indicates a non-blind reflected cross-site scripting issue. A blind XSS would not be detected in the same HTTP response; it would require a callback from a different user's browser.
- ✓
Reflected XSS with event handlers
Why this is correct
The tester found that the application reflects the input back in the HTTP response but filters out script tags. By injecting an event handler such as onerror within an HTML tag (e.g., <img src=x onerror=alert(1)>), the payload executes without needing a script element, thus bypassing the filter. This is a classic reflected XSS vector because the malicious script is included in the request and immediately rendered in the response, relying on the victim's interaction with a crafted link.
- ✗
DOM-based XSS
Why it's wrong here
DOM-based XSS arises when JavaScript in the page's Document Object Model processes untrusted data from sources like location.hash or document.referrer, and writes it to a sink without validation. The vulnerability discovered by the tester is apparent in the server's response, meaning the injection happens during HTML generation on the server side. If it were DOM-based, the response would be static and the payload would only execute after client-side scripts modify the DOM, which is not what the tester is observing here.
- ✗
Stored XSS
Why it's wrong here
Stored XSS occurs when the attacker's payload is permanently saved by the server (e.g., in a database or file) and executed whenever other users load the affected page. The tester's immediate discovery of the vulnerability in the immediate HTTP response indicates that the injection is a reflected, not persistent, attack. While stored XSS can also use event handlers to bypass filters, the key differentiator is that this vulnerability does not require persistence; it is triggered by a crafted request.
Go deeper
Related to this question
Learn chapter
Web Application Attacks
Key term
Payload
In IT and cybersecurity, a payload is the core data or malicious code delivered within a packet, file, or attack that performs the actual intended action.
Key term
XSS
Cross-Site Scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
About these practice questions
Courseiva writes every PT0-003 question from scratch — 777 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.