GWAPT · Question #98
Which vulnerability occurs when user input is returned in an HTTP response without proper encoding?
The correct answer is C. Reflected XSS. Reflected XSS (Cross-Site Scripting) occurs when user-supplied input (like a search query or URL parameter) is immediately echoed back in the HTTP response without sanitization or encoding - allowing an attacker to inject script tags that execute in the victim's browser. A…
Question
Which vulnerability occurs when user input is returned in an HTTP response without proper encoding?
Options
- ACSRF
- BSQL Injection
- CReflected XSS
- DCommand Injection
How the community answered
(45 responses)- A7% (3)
- B2% (1)
- C80% (36)
- D11% (5)
Explanation
Reflected XSS (Cross-Site Scripting) occurs when user-supplied input (like a search query or URL parameter) is immediately echoed back in the HTTP response without sanitization or encoding - allowing an attacker to inject script tags that execute in the victim's browser.
- A (CSRF) is wrong because Cross-Site Request Forgery tricks an authenticated user into making unwanted requests; it doesn't involve injecting code into responses.
- B (SQL Injection) is wrong because that targets database queries, not HTTP response output.
- D (Command Injection) is wrong because that exploits shell command execution on the server, not client-side response rendering.
Memory tip: Think "reflected" like a mirror - the attacker's malicious input is reflected right back at the victim in the response. If the response mirrors input without encoding it, it's Reflected XSS.
Community Discussion
No community discussion yet for this question.