CEH Web Application and Injection Attacks Practice Question
A security analyst discovers that a web application's search box reflects user input without proper sanitization. However, the attacker must trick a victim into clicking a crafted link containing the malicious script. This vulnerability is classified as which type?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reflected XSS
Reflected XSS requires user interaction (clicking a link) to execute the script in the victim's browser. The payload is not stored on the server, distinguishing it from stored XSS. DOM-based XSS does not involve server reflection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Blind XSS
Why it's wrong here
Blind XSS is a specialized form of stored XSS where the malicious payload is saved on the server but executes in a different, often administrative, context that the attacker cannot directly observe. Unlike typical reflected or stored XSS, the attacker doesn't immediately see the payload's effect on a user-facing page. This makes it unsuitable if the question implies an immediate, visible reflection or a direct user interaction with the vulnerable feature leading to immediate execution.
- ✗
Stored XSS
Why it's wrong here
Stored XSS, also known as Persistent XSS, involves injecting a malicious script directly into a web application's database or other persistent storage. Once saved, this payload is then served to every user who accesses the affected web page, without requiring them to click a specially crafted link. The attack is persistent because the malicious code resides on the server, making it distinct from scenarios where the payload is only reflected once per request.
- ✗
DOM-based XSS
Why it's wrong here
DOM-based XSS occurs entirely on the client-side when a web application's client-side script processes user-supplied data without proper sanitization, directly modifying the Document Object Model (DOM) in the victim's browser. The vulnerability does not involve the server reflecting the malicious payload; instead, the client-side JavaScript itself constructs and executes the malicious code. This distinguishes it from server-side XSS types where the server is responsible for embedding the script into the response.
- ✓
Reflected XSS
Why this is correct
Reflected XSS, also known as Non-Persistent XSS, occurs when a malicious script, typically embedded within a URL parameter or form input, is immediately processed and "reflected" back in the server's HTTP response to the user's browser without proper sanitization. This attack requires the victim to click a specially crafted link containing the payload, which then executes in their browser for that single request. The payload is not persistently stored on the server, making it a one-time execution per interaction.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.