thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Commonly confused · Application & OT Security

Stored vs Reflected vs DOM-Based XSS: What's the Difference?

Stored XSS saves the malicious script on the server so it hits every visitor, reflected XSS bounces the script off the server in an immediate response to a crafted link, and DOM-based XSS happens entirely in client-side JavaScript that unsafely handles data from the page.

Stored XSS

vs

Reflected XSS

vs

DOM-Based XSS

Stored XSSReflected XSSDOM-Based XSS
Where payload livesServer database (comments, profiles)Request parameter echoed backClient-side DOM, e.g. URL fragment
PersistencePersistentNon-persistentNon-persistent typically
DeliveryVictim simply views the pageVictim clicks a crafted linkVictim visits a crafted URL
Server sees payload?YesYesOften no
Impact scaleHighest, many usersPer victim who clicksPer victim who clicks
Fix focusEncode output when rendering stored dataEncode reflected output, validate inputUse safe DOM APIs (textContent), avoid innerHTML/eval
Remember it

Stored waits on the server, reflected bounces back, DOM never leaves the browser.

Exam tip

A malicious comment that attacks every reader is stored XSS. A phishing email with a long link containing script is reflected XSS.

Tested on

More Application & OT Security look-alikes