312-50 Question 298
Single answer▪ Web App ConceptsDuring an authorized web application assessment, you intercept the following HTTP request sent to a shopping site's search feature:
GET /search?q=laptop HTTP/1.1 Host: shop.example.com Cookie: SESSIONID=8f3a...
The application reflects the value of the q parameter directly into the HTML response inside the page body without encoding. You want to verify whether the application is vulnerable to reflected cross-site scripting (XSS) while minimizing impact on the application and avoiding unnecessary disruption to other users. Which payload is the most appropriate to test first?
- A
- B
' OR '1'='1
- C
- D
../../etc/passwd
Show answer and explanation
Correct answer: A
Explanation
This question tests understanding of web app input reflection and output context, which are core CEH web application concepts. Reflected XSS occurs when untrusted input is returned in an HTTP response and executed by the browser because the application fails to apply context-appropriate output encoding. In this scenario, the q parameter is reflected directly into the HTML page body, making a basic script injection payload the most appropriate initial validation step.
The key idea is to choose a payload that matches the rendering context. If input is reflected in raw HTML body content, a basic test is a reasonable first step. If the application filters script tags or reflects input inside an attribute, JavaScript string, or other context, different payloads may be required. This aligns with OWASP guidance on Cross Site Scripting Prevention, which emphasizes context-aware testing and defenses such as output encoding, input validation, and Content Security Policy as a defense-in-depth measure. The scenario also reflects real assessment methodology: start with the least complex payload that safely proves execution, then adjust based on observed filtering or encoding behavior.
- A. Correct.
Correct. A simple payload such as is a standard initial test for reflected XSS when input is reflected into the HTML body without output encoding. It is low impact, easy to verify, and directly tests whether the browser executes injected JavaScript in that context. In an authorized assessment, testers often begin with the simplest context-appropriate payload before escalating to more complex variants if filtering is present.
- B. Incorrect.
Incorrect. This is a classic SQL injection test payload, not an XSS payload. A candidate might choose it because the vulnerable parameter is user-controlled input, but the scenario specifically states that the value is reflected into HTML output, which points to a client-side injection issue rather than a database query manipulation issue.
- C. Incorrect.
Incorrect. This can also be a valid XSS payload and is often useful when
- D. Incorrect.
Incorrect. This is associated with directory traversal or local file inclusion testing, not reflected XSS. Someone might select it because the parameter is in a URL, but there is nothing in the scenario suggesting file path handling. It does not test the stated condition of unencoded reflection in the response body.