CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  HTTP Response Splitting

  Why it's wrong here

  This attack involves injecting CRLF characters (carriage return and line feed) into user-supplied input that is subsequently included in an HTTP response header. The goal is to manipulate the server's response by adding arbitrary new headers, such as Set-Cookie or Location, or even splitting the response into two distinct responses. The provided payload, "><script>alert('XSS')</script>", is designed to break out of HTML context and execute client-side script, not to inject HTTP header lines.

• ✗

  DOM-based XSS

  Why it's wrong here

  DOM-based Cross-Site Scripting occurs entirely within the client-side browser, where a malicious script is executed due to the improper handling of user-controllable data by client-side JavaScript. Unlike reflected or stored XSS, the vulnerability does not involve the server directly embedding the payload into the HTML response. Instead, the client-side script dynamically writes unsanitized input into the Document Object Model (DOM), leading to script execution.

• ✗

  Stored XSS

  Why it's wrong here

  Stored XSS, also known as Persistent XSS, involves injecting a malicious script that is permanently saved on the target server, typically in a database. When other users access the affected web page, the stored malicious script is retrieved from the database and delivered to their browsers, executing within their context. The scenario described, where a payload is sent and immediately reflected in the response, indicates a non-persistent attack rather than one involving long-term data storage.

• ✓

  Reflected XSS

  Why this is correct

  Reflected Cross-Site Scripting, or Non-Persistent XSS, occurs when a malicious script, often embedded in a URL parameter, is immediately returned by the web server in its HTTP response without proper sanitization. The browser then interprets and executes this unsanitized script as part of the legitimate page content. The payload "><script>alert('XSS')</script>" is characteristic of a reflected attack, designed to break out of an HTML context and execute client-side code upon immediate reflection.

Go deeper

Related to this question