CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Reflected XSS is a server-side vulnerability, while stored XSS is a client-side vulnerability

  Why it's wrong here

  This statement is incorrect because both Reflected and Stored Cross-Site Scripting (XSS) are fundamentally client-side vulnerabilities. While the server plays a role in processing or storing the malicious payload, the actual exploitation and execution of the script occur within the victim's web browser. The vulnerability arises from the browser's trust in content received from the server, which then executes unvalidated or improperly encoded data as legitimate script.

• ✓

  Reflected XSS is non-persistent and requires user interaction, while stored XSS is persistent and can affect multiple users

  Why this is correct

  This statement accurately describes the core differences. Reflected XSS is non-persistent because the malicious payload is delivered via a crafted URL or form submission and is immediately reflected in the server's response, requiring the victim to click a specific link. In contrast, Stored XSS is persistent; the malicious script is permanently saved on the target server (e.g., in a database) and is then served to any user who accesses the vulnerable web page, affecting multiple users without individual interaction beyond visiting the compromised page.

• ✗

  Reflected XSS only works with HTTP POST requests, while stored XSS works with GET requests

  Why it's wrong here

  This option is incorrect as Reflected XSS is not limited to HTTP POST requests; it can equally occur when malicious input is passed via URL parameters in an HTTP GET request. The method depends on where the application reflects user-supplied data. Stored XSS, on the other hand, is entirely independent of the HTTP request method used by the victim to retrieve the page; the payload is already stored server-side and delivered regardless of whether the victim's browser uses GET or POST to access the vulnerable resource.

• ✗

  Reflected XSS is triggered by the server, while stored XSS is triggered by the client

  Why it's wrong here

  This statement is inaccurate because the execution of the malicious script for both Reflected and Stored XSS is always "triggered" by the client's web browser. The server's role is to either reflect the payload back (Reflected XSS) or serve the pre-stored payload (Stored XSS). The browser then interprets and executes the script within the context of the vulnerable website, making the client the point of execution for both types.

Go deeper

Related to this question

Same concept, more angles

1 more way this is tested on CEH

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.