CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
A security team finds that a web application accepts a user-supplied URL and fetches it server-side without validation. The application runs on AWS EC2 with a metadata endpoint at 169.254.169.254. Which attack is MOST likely to succeed?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Server-Side Request Forgery (SSRF)
SSRF (Server-Side Request Forgery) occurs when an application fetches a user-controlled URL. By supplying the metadata endpoint, an attacker can retrieve IAM credentials, making this the most likely attack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SQL injection
Why it's wrong here
SQL injection exploits vulnerabilities in database queries, allowing attackers to manipulate or extract data by injecting malicious SQL code into input fields. The core mechanism involves altering server-side database commands, not initiating server-side requests to arbitrary URLs or internal network resources. The scenario describes server-side URL fetching, which is distinct from direct database interaction and does not involve manipulating SQL statements.
- ✓
Server-Side Request Forgery (SSRF)
Why this is correct
The application fetches a user-supplied URL server-side without validation, enabling an attacker to craft a request to the internal AWS metadata endpoint at 169.254.169.254. This SSRF attack exploits the lack of input sanitisation to retrieve instance metadata, such as IAM credentials, because the server trusts its own network context. The stem’s constraint—unvalidated server-side URL fetching—directly enables this attack vector.
- ✗
Remote file inclusion (RFI)
Why it's wrong here
Remote File Inclusion (RFI) vulnerabilities occur when a web application dynamically includes external files based on user input without proper validation. While both RFI and SSRF involve fetching external resources, RFI's primary goal is to execute code from the included remote file on the server, often leading to arbitrary code execution. The described scenario focuses on the server making a request to an *internal* endpoint (AWS metadata), not necessarily including and executing a remote file for code execution.
- ✗
Cross-site scripting (XSS)
Why it's wrong here
Cross-Site Scripting (XSS) involves injecting malicious client-side scripts (typically JavaScript) into web pages viewed by other users. These scripts execute within the victim's browser, allowing attackers to steal cookies, deface websites, or redirect users. XSS operates entirely on the client-side, manipulating what the user's browser renders, and does not involve the server itself making unvalidated requests to internal or external URLs.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.