Stored XSS Indicators: What to Look For
Which of the following is a common indicator of a stored (persistent) Cross-Site Scripting (XSS) attack?
Quick Answer
The correct answer is that a script permanently stored on the server and executed when users view a page is the definitive indicator of stored XSS. This is because stored, or persistent, XSS injects malicious code directly into a server-side resource like a database, comment field, or forum post, meaning the payload becomes part of the page’s HTML response and executes automatically in every visitor’s browser without any user interaction. On the Certified Ethical Hacker CEH exam, this question tests your ability to distinguish stored XSS from reflected or DOM-based variants, where the payload is not permanently hosted. A common trap is confusing stored XSS with reflected XSS, which requires a user to click a crafted link. Remember the memory tip: “Stored is served; reflected is requested.” If the script is always there for anyone who loads the page, it is stored.
⚠ Common exam trap
A common mix-up: candidates confuse stored XSS with reflected XSS, mistakenly thinking that any script execution without user interaction (Option A) is stored XSS, when in fact stored XSS specifically requires the payload to be persisted on the server and served to multiple users.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A script is permanently stored on the server and executed when users view a page
Stored (persistent) XSS occurs when malicious script is permanently stored on the server (e.g., in a database, comment field, or forum post) and is served to every user who views the affected page. The script executes in the victim's browser without requiring any additional interaction, as it is part of the page's HTML response from the server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A script executes in the victim's browser without any server interaction
Why it's wrong here
That describes DOM-based XSS.
- ✓
A script is permanently stored on the server and executed when users view a page
Why this is correct
Stored XSS persists on the server and affects all users viewing the content.
- ✗
A script is executed when a user submits a form with malicious input
Why it's wrong here
That could be reflected or stored depending on how the input is handled.
- ✗
A script executes only after clicking a manipulated URL
Why it's wrong here
That describes reflected XSS.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a penetration test, a tester uses the following payload in a search field: <script>alert(document.cookie)</script>. The payload is reflected in the response without sanitization. However, the tester notices that the attack only works when the payload is submitted via a POST request, not GET. Which type of XSS is this?
hard- A.Stored XSS
- ✓ B.Reflected XSS
- C.DOM-based XSS
- D.Self-XSS
Why B: Reflected XSS occurs when the payload is reflected immediately in the response. The fact that it works via POST but not GET does not change the classification; it is still reflected XSS because the payload is not stored on the server. Some reflected XSS may be triggered only via POST parameters.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.