CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Submit a base64-encoded payload in a cookie

  Why it's wrong here

  Submitting a base64-encoded payload within a cookie is primarily associated with vulnerabilities like deserialization attacks, Cross-Site Scripting (XSS), or session manipulation, not Server-Side Request Forgery (SSRF). Cookies are client-side storage mechanisms, and while their content can be processed by the server, merely encoding data in base64 within a cookie does not inherently compel the server to initiate an outbound network request to an arbitrary URL, which is the defining characteristic of SSRF.

• ✗

  Use SQLMap with a time-based payload

  Why it's wrong here

  Using SQLMap with a time-based payload is a specialized technique and tool designed exclusively for detecting and exploiting SQL injection vulnerabilities. SQLMap automates the process of injecting malicious SQL queries into database inputs, and a time-based payload is a method to extract information when direct output is suppressed. This methodology is entirely distinct from SSRF, which involves manipulating a server to make HTTP requests to internal or external resources on an attacker's behalf.

• ✗

  Modify the Host header to point to localhost

  Why it's wrong here

  Modifying the Host header to point to localhost primarily tests for Host Header Injection or routing bypass vulnerabilities, not Server-Side Request Forgery. The Host header dictates which virtual host or application the web server should route the incoming request to, influencing server-side logic related to domain names. It does not, however, typically cause the server to initiate a new, arbitrary outbound HTTP request based on a URL provided in a separate parameter, which is the core mechanism of SSRF.

• ✓

  Send a request with a URL parameter pointing to an internal IP address

  Why this is correct

  Sending a request with a URL parameter pointing to an internal IP address is the correct method to test for Server-Side Request Forgery (SSRF). SSRF exploits occur when a web application fetches a remote resource based on user-supplied input. By providing an internal IP address (e.g., `127.0.0.1`, `10.0.0.1`) in a parameter that the server is expected to process and fetch, an attacker can determine if the server attempts to connect to that internal resource. Successful connection attempts, even if resulting in an error, indicate the presence of an SSRF vulnerability.

Go deeper

Related to this question