CEH Web Application and Injection Attacks Practice Question
An analyst reviews a web server log and sees the following request: GET /search?q=<script>alert('xss')</script> HTTP/1.1. The response from the server includes the search term inside a <div> tag without any sanitization. Which type of XSS vulnerability does this indicate?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reflected XSS
This is a typical reflected XSS because the malicious script is injected via a GET parameter and immediately reflected in the response without persistent storage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Stored XSS
Why it's wrong here
Stored Cross-Site Scripting (XSS), also known as persistent XSS, involves injecting a malicious script that is permanently saved on the target server, typically in a database, comment section, or forum post. When other users subsequently access the compromised web page, the stored payload is retrieved from the server and executed in their browsers. The provided web server log, however, indicates an immediate reflection of the script within the same request, rather than a persistent storage and subsequent serving to multiple users, making it distinct from stored XSS.
- ✓
Reflected XSS
Why this is correct
Reflected Cross-Site Scripting (XSS) occurs when a malicious script, typically injected through a URL parameter or form input, is immediately processed by the server and returned within the HTTP response to the user's browser without proper sanitization. The script is not stored on the server; instead, it "reflects" off the server back to the user who made the request. The web server log showing the script directly in the request and implying an immediate response aligns perfectly with this non-persistent, server-side reflection mechanism.
- ✗
DOM-based XSS
Why it's wrong here
DOM-based Cross-Site Scripting (XSS) is a client-side vulnerability where the malicious payload is executed due to unsafe manipulation of the Document Object Model (DOM) by client-side JavaScript, without the server ever processing or reflecting the script. The vulnerability arises when client-side script reads data from a URL (e.g., document.URL, location.hash) and uses it to dynamically write content into the HTML page without proper sanitization. The web server log, however, indicates the server itself is reflecting the input, pointing to a server-side vulnerability rather than a purely client-side DOM manipulation issue.
- ✗
Blind XSS
Why it's wrong here
Blind Cross-Site Scripting (XSS) is a specialized form of stored XSS where the attacker injects a payload, but its execution is not immediately visible to them. Instead, the script is stored and later triggered in a different part of the application, often an administrative dashboard, a backend system, or a different user's interface, which the attacker cannot directly observe. The web server log, by showing an immediate reflection back to the requesting user, does not align with the delayed, out-of-sight execution characteristic of blind XSS.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.