CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  The attack is typically delivered through a crafted link

  Why this is correct

  Reflected Cross-Site Scripting (XSS) attacks are typically initiated when an attacker crafts a malicious URL containing the injected script and then tricks a victim into clicking it. This delivery mechanism is crucial because the malicious payload is not persistently stored on the server. Instead, the victim's browser sends the crafted URL to the vulnerable web application, which then reflects the script back in the immediate HTTP response, executing it in the victim's browser context.

• ✗

  The script executes in the server-side context

  Why it's wrong here

  Cross-Site Scripting (XSS) vulnerabilities, including reflected XSS, are fundamentally client-side attacks. The malicious script, typically JavaScript, is injected into the web page and executed by the victim's web browser, not on the web server itself. The server merely reflects the input without proper sanitization, allowing the browser to interpret and run the injected code within the user's session context, impacting only the client's interaction with the site.

• ✗

  The attack affects all users who visit the compromised page without any interaction

  Why it's wrong here

  This characteristic describes a stored (or persistent) XSS attack, not a reflected one. In stored XSS, the malicious script is permanently embedded within the web application's database or file system, such as in comments or profile fields. Consequently, any user who subsequently accesses the compromised page will automatically execute the script without needing to click a specific malicious link, making its impact far broader and less reliant on individual user interaction.

• ✓

  The malicious script is reflected off the web server in the response

  Why this is correct

  A defining characteristic of reflected XSS is that the malicious input provided by the attacker is immediately and non-persistently returned ("reflected") in the server's HTTP response to the user's request. The server processes the request containing the script and, due to a lack of proper input validation or output encoding, embeds the script directly into the HTML response. The browser then renders and executes this script, but this reflection is transient, occurring only for that specific request.

• ✗

  The malicious script is permanently stored on the server

  Why it's wrong here

  This statement accurately describes a stored (or persistent) XSS attack, where the malicious script is saved within the web application's backend, such as a database, comment section, or profile field. The script remains on the server until explicitly removed. In contrast, reflected XSS does not involve any permanent storage of the script on the server; the script is merely passed through the server and immediately returned in the HTTP response, making it a non-persistent vulnerability.

Go deeper

Related to this question