CEH Web Application and Injection Attacks Practice Question
During a penetration test, a tester uses the following payload in a search field: <script>alert(document.cookie)</script>. The payload is reflected in the response without sanitization. However, the tester notices that the attack only works when the payload is submitted via a POST request, not GET. Which type of XSS is this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reflected XSS
Reflected XSS occurs when the payload is reflected immediately in the response. The fact that it works via POST but not GET does not change the classification; it is still reflected XSS because the payload is not stored on the server. Some reflected XSS may be triggered only via POST parameters.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Stored XSS
Why it's wrong here
Stored XSS, also known as persistent XSS, involves the attacker injecting a malicious script that is permanently saved on the target server, typically within a database or file system. This stored payload is then delivered to all subsequent users who access the affected web page or resource, leading to widespread compromise without further attacker interaction. Because the script persists on the server, it can affect numerous victims over an extended period, making it a highly dangerous form of XSS.
- ✓
Reflected XSS
Why this is correct
Reflected XSS occurs when a malicious script embedded in an HTTP request (e.g., a URL parameter or form field) is immediately echoed back in the server's HTTP response without proper sanitization. The victim's browser then executes this script upon rendering the page, but the payload itself is not stored on the server for future use or delivery to other users. This type of attack typically requires an attacker to trick a victim into clicking a specially crafted malicious link that contains the payload.
- ✗
DOM-based XSS
Why it's wrong here
This attack occurs entirely on the client-side, where the malicious payload is executed due to a client-side script modifying the Document Object Model (DOM) environment. Unlike other XSS types, the server does not process the malicious input in a way that leads to its reflection or storage; instead, the vulnerability arises from client-side code dynamically writing unsanitized data, often from the URL (e.g., "location.hash"), directly into the page. The server's response itself is not inherently malicious.
- ✗
Self-XSS
Why it's wrong here
Self-XSS is a type of cross-site scripting where the victim themselves must manually inject and execute the malicious script, typically by pasting it into their browser's developer console or an input field that is only processed client-side. This vulnerability cannot be exploited by an attacker to target other users or even the victim without significant social engineering to convince the victim to actively run the code. It primarily relies on tricking users into compromising their own session rather than a server-side vulnerability.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.