CEH Network and Web Application Attacks Practice Question

Exhibit

Refer to the exhibit.
GET /search?q=<script>alert('XSS')</script> HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0

HTTP/1.1 200 OK
Content-Type: text/html

<html><body>You searched for: <script>alert('XSS')</script></body></html>

Refer to the exhibit. A security analyst captured the HTTP request and response shown. What type of vulnerability is present?

⚠ Common exam trap

EC-Council often tests the distinction between reflected XSS and stored XSS, but the trap here is confusing reflected XSS with CSRF because both involve crafted URLs, but CSRF does not execute JavaScript in the response—it forges a state-changing request using the victim's session.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Reflected Cross-Site Scripting (XSS)

The HTTP response contains the search query parameter directly reflected in the HTML body without proper sanitization or encoding. Specifically, the request includes `?search=<script>alert('XSS')</script>` and the response echoes this payload verbatim in the page content, allowing the browser to execute the injected JavaScript. This is the classic signature of a reflected cross-site scripting (XSS) vulnerability, where the malicious script is immediately reflected off the web server and executed in the user's browser.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Cross-Site Request Forgery (CSRF)
Why it's wrong here
Cross-Site Request Forgery (CSRF) attacks involve coercing an authenticated user's browser to send an unintended request to a trusted web application. This typically occurs when a victim visits a malicious site that contains a hidden request targeting another site where they are logged in. The provided HTTP exhibit does not show a request originating from a different domain or any mechanism designed to trick a user's browser into making an unwanted, authenticated request to the server.
✗
SQL Injection
Why it's wrong here
SQL Injection is a code injection technique used to attack data-driven applications, where malicious SQL statements are inserted into an entry field for execution. An exhibit demonstrating SQL injection would typically show user input containing specific SQL syntax, such as single quotes, comments (`--`), or keywords like `UNION` or `SELECT`, aimed at manipulating backend database queries. The captured HTTP request and response in the exhibit contain no such database-specific syntax or indicators of backend query manipulation.
✓
Reflected Cross-Site Scripting (XSS)
Why this is correct
Reflected Cross-Site Scripting (XSS) occurs when a malicious script, often embedded within a URL parameter or form input, is immediately and unsafely echoed back in the web server's HTTP response. The victim's browser then interprets and executes this injected script as part of the legitimate webpage content. The exhibit clearly shows user input containing script tags being directly reflected into the HTML response without proper sanitization, leading to client-side script execution, which is the hallmark of a reflected XSS vulnerability.
✗
Directory Traversal
Why it's wrong here
Directory Traversal, also known as Path Traversal, is an attack that allows an attacker to access files and directories stored outside the web root folder by manipulating file paths in user-supplied input. This vulnerability typically involves using sequences like `../` or `..\` to navigate the server's file system. The provided HTTP request and response do not contain any attempts to modify file paths or access system files beyond the intended application scope, which would be indicative of a directory traversal attempt.

Go deeper

CEH Network and Web Application Attacks Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question