GPEN · Question #425
GPEN Question #425: Real Exam Question with Answer & Explanation
The correct answer is A. Stored XSS. because it may be located anywhere within static or dynamic sitecontent. Stored XSS (persistent XSS) is the hardest for automated tools to detect because the malicious payload is saved server-side (database, file system) and may be rendered anywhere across the application - in user profiles, comment threads, admin panels, or third-party integrations.
Question
Options
- AStored XSS. because it may be located anywhere within static or dynamic sitecontent
- BStored XSS. because it depends on emails and instant messaging systems.
- CReflected XSS. because It can only be found by analyzing web server responses.
- DReflected XSS: because it is difficult to find within large web server logs.
Explanation
Stored XSS (persistent XSS) is the hardest for automated tools to detect because the malicious payload is saved server-side (database, file system) and may be rendered anywhere across the application - in user profiles, comment threads, admin panels, or third-party integrations. Automated scanners work by injecting test payloads and immediately checking whether the payload appears in the HTTP response to that same request. With stored XSS, the payload is stored silently, then rendered to a different user, on a different page, or under conditions the scanner never encounters - breaking the injection-to-reflection feedback loop the scanner relies on. Reflected XSS, by contrast, echoes the payload directly in the server's response to the same request, making it straightforward for automated tools to detect.
Community Discussion
No community discussion yet for this question.