CEH Web Application and Injection Attacks Practice Question
A tester sends the following payload to a web application: %3Cscript%3Ealert('XSS')%3C/script%3E. The application echoes back the decoded payload in the response without sanitization. This behavior is typical of which type of vulnerability?
⚠ Common exam trap
CEH often tests the difference between reflected, stored, and DOM-based XSS; candidates may confuse reflected with stored because both involve echoing, but reflected is immediate and not persistent.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reflected XSS
Reflected XSS occurs when an application immediately echoes user-supplied input in the response without proper sanitization. The payload is not stored on the server but reflected back to the user, executing in the victim's browser. The given payload is URL-encoded and decoded by the server, then echoed, which is typical of reflected XSS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
HTTP Response Splitting
Why it's wrong here
This attack involves injecting CRLF characters (carriage return and line feed) into user-supplied input that is subsequently included in an HTTP response header. The goal is to manipulate the server's response by adding arbitrary new headers, such as Set-Cookie or Location, or even splitting the response into two distinct responses. The provided payload, "><script>alert('XSS')</script>", is designed to break out of HTML context and execute client-side script, not to inject HTTP header lines.
- ✗
DOM-based XSS
Why it's wrong here
DOM-based Cross-Site Scripting occurs entirely within the client-side browser, where a malicious script is executed due to the improper handling of user-controllable data by client-side JavaScript. Unlike reflected or stored XSS, the vulnerability does not involve the server directly embedding the payload into the HTML response. Instead, the client-side script dynamically writes unsanitized input into the Document Object Model (DOM), leading to script execution.
- ✗
Stored XSS
Why it's wrong here
Stored XSS, also known as Persistent XSS, involves injecting a malicious script that is permanently saved on the target server, typically in a database. When other users access the affected web page, the stored malicious script is retrieved from the database and delivered to their browsers, executing within their context. The scenario described, where a payload is sent and immediately reflected in the response, indicates a non-persistent attack rather than one involving long-term data storage.
- ✓
Reflected XSS
Why this is correct
Reflected Cross-Site Scripting, or Non-Persistent XSS, occurs when a malicious script, often embedded in a URL parameter, is immediately returned by the web server in its HTTP response without proper sanitization. The browser then interprets and executes this unsanitized script as part of the legitimate page content. The payload "><script>alert('XSS')</script>" is characteristic of a reflected attack, designed to break out of an HTML context and execute client-side code upon immediate reflection.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 913 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official EC-Council exam blueprint
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.