CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Implement a whitelist of allowed domains and IP addresses for outbound requests

  Why this is correct

  Implementing a whitelist of allowed domains and IP addresses for outbound requests is the most effective defense against Server-Side Request Forgery (SSRF). This robust control ensures the server can only initiate connections to explicitly permitted external resources or internal services. By strictly restricting outbound connections to a predefined, trusted list, any attempt by an attacker to force the server to connect to unauthorized internal systems or arbitrary external hosts will be blocked, directly mitigating the SSRF vulnerability.

• ✗

  Use input validation to block URLs containing '127.0.0.1' or 'localhost'

  Why it's wrong here

  Using input validation to block URLs containing specific strings like '127.0.0.1' or 'localhost' is an insufficient and easily bypassable control for SSRF prevention. Attackers can circumvent such simple blacklists through numerous techniques, including alternative IP representations (e.g., decimal, octal, hexadecimal), URL encoding, or DNS rebinding. This approach provides a false sense of security, as it fails to address the fundamental ability of the server to make requests to arbitrary destinations.

• ✗

  Implement CSRF tokens on all forms

  Why it's wrong here

  Implementing Cross-Site Request Forgery (CSRF) tokens on all forms is a security measure designed to prevent attackers from tricking a user's browser into sending unauthorized requests to a web application. However, CSRF tokens offer no protection against Server-Side Request Forgery (SSRF). SSRF exploits the server's own capability to make outbound requests based on malicious input, independent of user browser actions or form submissions, rendering CSRF tokens irrelevant to this specific vulnerability.

• ✗

  Disable unnecessary HTTP methods on the web server

  Why it's wrong here

  Disabling unnecessary HTTP methods on the web server, such as PUT or DELETE, is a good security practice for reducing the attack surface against certain types of web attacks or information disclosure. Nevertheless, this action does not mitigate Server-Side Request Forgery (SSRF). SSRF vulnerabilities arise from the server's internal logic making outbound requests based on user-supplied input, regardless of which HTTP methods are enabled for incoming requests to the web server itself. The core issue is the server's ability to make unauthorized outbound connections, not its exposed HTTP methods.

Go deeper

Related to this question