CREST Practitioner Security Analyst (CPSA) Practice

What characteristic defines Persistent XSS?

1. It is only executed once

2. It retrieves data from external sources

3. It remains on the website until removed

4. It affects only individual sessions

The correct answer is: It remains on the website until removed

The defining characteristic of Persistent XSS (Cross-Site Scripting) is that it remains on the website until it is removed. This type of XSS occurs when malicious scripts are injected into a web application and are stored on the server, typically in a database. When other users access the affected web page, the stored script is delivered and executed in their browsers. This permanence allows the attack to affect a wider audience over time, as any user who visits the compromised page may unknowingly execute the malicious script. In contrast, the other characteristics listed do not accurately describe Persistent XSS. It is not limited to a one-time execution, nor does it inherently retrieve data from external sources. Additionally, it does not restrict its effects to individual sessions; rather, it impacts multiple users who access the infected site. This is crucial for understanding how Persistent XSS can lead to more severe impacts compared to other types of XSS, such as reflected attacks.