CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The attack requires the victim to click a crafted link

  Why it's wrong here

  Stored XSS does not necessitate a victim clicking a specially crafted link. Instead, the malicious script executes automatically in the victim's browser simply by navigating to and viewing the compromised web page where the payload has been persistently stored on the server. This contrasts sharply with Reflected XSS, which typically relies on a user interacting with a malicious URL to trigger the attack.

• ✗

  The payload is reflected immediately in the response

  Why it's wrong here

  This characteristic accurately describes Reflected Cross-Site Scripting, where a malicious payload is immediately returned in the HTTP response generated by the server, often as part of an error message or search result, without being stored. In contrast, Stored XSS involves the server permanently saving the malicious script within its backend, which is then served to subsequent users upon request, rather than being a transient, non-persistent reflection.

• ✓

  The malicious script is stored on the server (e.g., in a database)

  Why this is correct

  A defining characteristic of Stored XSS, also known as Persistent XSS, is that the attacker's malicious script is successfully injected into and saved within the web application's backend infrastructure, such as a database, comment section, or user profile. This persistence means the payload remains on the server, ready to be delivered to any user who later requests the affected content, making it a highly potent and widespread threat.

• ✗

  The attack only works if the victim is logged in

  Why it's wrong here

  The execution of a Stored XSS payload is a client-side event, occurring within the victim's web browser when they access the compromised page, irrespective of their authentication status. If the page containing the malicious script is publicly accessible, the attack will affect both logged-in and unauthenticated users alike, as the browser simply renders the content it receives from the server. User login status is not a prerequisite for script execution in this scenario.

• ✓

  The attack can affect multiple users without direct interaction

  Why this is correct

  Once a malicious script is successfully stored on the server, it becomes a persistent threat that can automatically affect any user who subsequently views the compromised web page or content. This allows a single injection to impact a broad audience without requiring the attacker to individually target each victim or trick them into clicking specific links, making it a 'worm-like' attack that spreads passively to all visitors.

Go deeper

Related to this question