GWAPT · Question #135
In a Reflected Cross-Site Scripting attack, where is the malicious payload executed?
The correct answer is B. Within the victim's browser via an HTTP response. In Reflected XSS, an attacker crafts a malicious URL containing a script payload; when a victim clicks it, the server "reflects" the payload back in the HTTP response, and the victim's browser executes it - making B correct. Option A is wrong because no database is involved…
Question
In a Reflected Cross-Site Scripting attack, where is the malicious payload executed?
Options
- AOn the server-side database
- BWithin the victim's browser via an HTTP response
- CAs part of the network traffic analysis
- DIn the server's application logs
How the community answered
(48 responses)- A15% (7)
- B75% (36)
- C6% (3)
- D4% (2)
Explanation
In Reflected XSS, an attacker crafts a malicious URL containing a script payload; when a victim clicks it, the server "reflects" the payload back in the HTTP response, and the victim's browser executes it - making B correct. Option A is wrong because no database is involved; the payload never reaches persistent storage. Option C is wrong because network traffic carries the payload but doesn't execute it - execution happens at the endpoint, not in transit. Option D is wrong because application logs may record the request, but logs don't run code.
Memory tip: Think of "Reflected" like a mirror - the server bounces the attacker's script straight back to the victim's browser, which is the only thing in this chain capable of rendering and executing JavaScript.
Community Discussion
No community discussion yet for this question.