CEH Web Application and Injection Attacks Practice Question
During a security assessment, a tester discovers an endpoint that reflects the 'User-Agent' header in the response without sanitization. The tester wants to confirm a reflected XSS vulnerability. Which of the following payloads would be MOST effective to demonstrate the issue in a single request?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the User-Agent to: <script>alert('XSS')</script>
Using a simple script alert like <script>alert(1)</script> is a standard proof-of-concept for reflected XSS. The exact payload may vary, but it must execute JavaScript. The simplest is an alert.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set the User-Agent to: <img src=x onerror=alert(1)>
Why it's wrong here
This payload uses an image tag with an onerror event, which could also trigger XSS if the image fails to load. However, it is not the most straightforward proof-of-concept; a simple <script> tag is more direct and reliable for demonstrating reflected XSS in a single request.
- ✗
Set the User-Agent to: ' OR '1'='1
Why it's wrong here
This payload, ' OR '1'='1, is a classic SQL injection attempt designed to manipulate backend database queries. If the User-Agent string were directly concatenated into a SQL query without proper sanitization, this could allow an attacker to bypass authentication or extract sensitive data by forcing a true condition. However, this is a server-side attack targeting the database and would not cause a web browser to execute client-side JavaScript, which is the defining characteristic of a Cross-Site Scripting (XSS) vulnerability.
- ✓
Set the User-Agent to: <script>alert('XSS')</script>
Why this is correct
This payload, <script>alert('XSS')</script>, is the most direct and effective proof-of-concept for demonstrating a reflected Cross-Site Scripting (XSS) vulnerability. When the User-Agent header containing this string is reflected unencoded into the HTML response generated by the web application, the browser interprets the <script> tags and executes the embedded JavaScript. The alert('XSS') function then triggers a pop-up box, visually confirming that arbitrary client-side script execution is possible within the victim's browser context.
- ✗
Set the User-Agent to: ../../../../etc/passwd
Why it's wrong here
The payload ../../../../etc/passwd represents a path traversal (or directory traversal) attack, aiming to access arbitrary files on the server's filesystem. If the application processes the User-Agent string in a way that constructs a file path without proper validation or sanitization, this could allow an attacker to read sensitive system files like the Unix password file. This is a server-side vulnerability focused on unauthorized file system access, fundamentally distinct from XSS, which involves client-side script execution in the user's browser.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.