CEH Web Application and Injection Attacks Practice Question
A web application tester notices that the application reflects user input in the URL without proper encoding. The tester submits a payload <script>alert('xss')</script> in a search field and the script executes in the browser. Which type of XSS vulnerability is this MOST likely?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reflected XSS
Reflected XSS occurs when user input is immediately returned by the server in the response without proper sanitization. The script executes once and is not stored, distinguishing it from stored XSS. DOM-based XSS would involve client-side JavaScript manipulation without server reflection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Blind XSS
Why it's wrong here
Blind XSS involves injecting a malicious payload that is stored on the server but executed in a different, often backend, context not directly visible to the attacker. The attacker does not receive an immediate response reflecting the payload; instead, they rely on out-of-band communication, such as an XSS hunter service, to confirm successful execution. This scenario differs from the immediate reflection observed by the tester in the question stem.
- ✓
Reflected XSS
Why this is correct
Reflected XSS occurs when a malicious script injected into an HTTP request is immediately returned in the server's HTTP response without being permanently stored. The payload is non-persistent, executing only once in the victim's browser as part of that specific request and response cycle. The observation that the application 'reflects' the input directly aligns with this immediate, one-time execution characteristic, making it the correct answer.
- ✗
Stored (persistent) XSS
Why it's wrong here
Stored, or persistent, XSS involves injecting a malicious script that is permanently saved on the target server, typically in a database, comment section, or file system. This payload is then delivered to all subsequent users who access the compromised web page, executing automatically in their browsers. Unlike the immediate, non-persistent reflection described, stored XSS allows the attack to persist and affect multiple victims over time.
- ✗
DOM-based XSS
Why it's wrong here
DOM-based XSS arises entirely on the client-side when a web application's JavaScript processes user-supplied data without proper sanitization, directly modifying the Document Object Model (DOM) in the victim's browser. The server does not process, store, or reflect the malicious input in this type of attack. The vulnerability originates from client-side script execution rather than server-side reflection, making it distinct from the scenario described.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.