CEH Web Application and Injection Attacks Practice Question
A penetration tester discovers that a web application's search functionality reflects user input directly in the page source without sanitization. The tester crafts a URL like http://example.com/search?q=<script>alert('XSS')</script> and the script executes. This is an example of which type of XSS?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reflected XSS
Reflected XSS occurs when user input is immediately returned by the server in the response, without being stored, and the example shows the payload in the URL parameter.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Stored (persistent) XSS
Why it's wrong here
Stored (persistent) XSS occurs when a malicious script is permanently saved on the target server, typically in a database, forum post, or comment section. When other users access the affected web page, the server retrieves and delivers the stored payload within the legitimate content, causing it to execute in their browsers. This differs from the scenario where the payload is merely present in the URL, as that implies no server-side persistence of the malicious script for later retrieval.
- ✗
Blind XSS
Why it's wrong here
Blind XSS is a specialized form of stored XSS where the injected payload is not immediately visible or executed by the attacker. Instead, it is stored on the server and later triggered in a different, often internal or administrative, application context that the attacker cannot directly observe. For instance, an XSS payload submitted in a feedback form might execute when an administrator views the submission in a backend panel, making it 'blind' to the initial attacker.
- ✗
DOM-based XSS
Why it's wrong here
DOM-based XSS vulnerabilities arise entirely client-side, where the malicious payload manipulates the Document Object Model (DOM) of the web page without any server-side processing or reflection of the input. The vulnerability occurs when client-side script uses user-controllable data to dynamically write to the DOM, such as `document.write()` or `innerHTML`, without proper sanitization. This means the server never sees the malicious script as part of the response content it generates, distinguishing it from server-reflected attacks.
- ✓
Reflected XSS
Why this is correct
Reflected XSS occurs when a malicious script, supplied in an HTTP request, is immediately and unsafely echoed back in the server's HTTP response. The server takes user-supplied input, often from a URL parameter, and directly embeds it into the HTML page without adequate sanitization or encoding. This causes the victim's browser to execute the script upon receiving the crafted response, making it a non-persistent, single-request attack.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.