CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Ability to perform a man-in-the-middle attack on the user's browser

  Why it's wrong here

  SSRF is a server-side vulnerability where the compromised server makes requests on behalf of the attacker. It does not operate at the client-side browser level to intercept user traffic or modify browser-server communication directly. Performing a man-in-the-middle (MiTM) attack on a user's browser would require client-side compromise, network interception between the user and the legitimate server, or a compromised certificate authority, none of which are direct capabilities of an SSRF vulnerability.

• ✓

  Access to cloud instance metadata (e.g., AWS IMDS)

  Why this is correct

  SSRF enables a malicious actor to force the vulnerable server to make requests to internal endpoints. Cloud instance metadata services, such as AWS IMDS (Instance Metadata Service), are often accessible from the instance itself via a well-known internal IP address (e.g., 169.254.169.254). An SSRF vulnerability can be leveraged to query these services, potentially retrieving sensitive information like temporary IAM role credentials, user data, or network configuration details, which can then be used for privilege escalation or further attacks within the cloud environment.

• ✗

  Direct modification of DNS records

  Why it's wrong here

  SSRF allows a server to make requests to arbitrary URLs, but it does not inherently grant administrative access to external DNS management systems. Modifying DNS records requires authenticated access to a DNS registrar or server, which is a distinct administrative function. While SSRF could potentially be a step in a multi-stage attack to reach a vulnerable internal DNS management interface, it does not directly provide the capability to alter public DNS records.

• ✓

  Remote code execution on internal servers

  Why this is correct

  SSRF can be a critical precursor to achieving Remote Code Execution (RCE) on internal systems. By forcing the vulnerable server to interact with other internal services, an attacker can discover and exploit vulnerabilities in those services that are not exposed to the public internet. For example, an SSRF attack might target an an internal web application with a known RCE flaw, an unpatched internal API, or a service that processes external input without proper sanitization, leading to arbitrary code execution on the targeted internal server.

• ✗

  Direct access to the database without authentication

  Why it's wrong here

  While SSRF can be used to probe internal network services, directly accessing a database without authentication is not a guaranteed outcome. Databases typically require specific protocols (e.g., SQL, NoSQL APIs) and authentication credentials. An SSRF vulnerability might allow the attacker to discover the database's internal IP and port, but it doesn't bypass the need for authentication or the correct protocol to interact with it. Gaining direct, unauthenticated access would require a separate vulnerability in the database itself or a misconfiguration, not solely the SSRF.

Go deeper

Related to this question