CEH Web Application and Injection Attacks Practice Question

An analyst reviews a web server log and sees the following request: GET /search?q=<script>alert('xss')</script> HTTP/1.1. The response from the server includes the search term inside a <div> tag without any sanitization. Which type of XSS vulnerability does this indicate?

⚠ Common exam trap

The trap is distinguishing reflected from DOM-based XSS — candidates see a script in a URL and assume DOM-based, but the presence of the payload in the server's HTTP response confirms reflected XSS.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Reflected XSS

The payload appears in the URL query string and is immediately echoed back in the response inside a <div> without sanitization. This is the classic signature of reflected XSS: the malicious script is not stored on the server but is reflected from the request to the response, executing in the victim's browser when they click a crafted link. The single request/response cycle in the log confirms it is not stored.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Stored XSS
Why it's wrong here
Stored Cross-Site Scripting (XSS), also known as persistent XSS, involves injecting a malicious script that is permanently saved on the target server, typically in a database, comment section, or forum post. When other users subsequently access the compromised web page, the stored payload is retrieved from the server and executed in their browsers. The provided web server log, however, indicates an immediate reflection of the script within the same request, rather than a persistent storage and subsequent serving to multiple users, making it distinct from stored XSS.
✓
Reflected XSS
Why this is correct
Reflected Cross-Site Scripting (XSS) occurs when a malicious script, typically injected through a URL parameter or form input, is immediately processed by the server and returned within the HTTP response to the user's browser without proper sanitization. The script is not stored on the server; instead, it "reflects" off the server back to the user who made the request. The web server log showing the script directly in the request and implying an immediate response aligns perfectly with this non-persistent, server-side reflection mechanism.
✗
DOM-based XSS
Why it's wrong here
DOM-based Cross-Site Scripting (XSS) is a client-side vulnerability where the malicious payload is executed due to unsafe manipulation of the Document Object Model (DOM) by client-side JavaScript, without the server ever processing or reflecting the script. The vulnerability arises when client-side script reads data from a URL (e.g., document.URL, location.hash) and uses it to dynamically write content into the HTML page without proper sanitization. The web server log, however, indicates the server itself is reflecting the input, pointing to a server-side vulnerability rather than a purely client-side DOM manipulation issue.
✗
Blind XSS
Why it's wrong here
Blind Cross-Site Scripting (XSS) is a specialized form of stored XSS where the attacker injects a payload, but its execution is not immediately visible to them. Instead, the script is stored and later triggered in a different part of the application, often an administrative dashboard, a backend system, or a different user's interface, which the attacker cannot directly observe. The web server log, by showing an immediate reflection back to the requesting user, does not align with the delayed, out-of-sight execution characteristic of blind XSS.

Go deeper

CEH Web Application and Injection Attacks Practice Question

Why each option matters

Option-by-option breakdown

Related to this question