CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Exploit a command injection vulnerability in the web server

  Why it's wrong here

  Server-Side Request Forgery (SSRF) enables an attacker to force the server to make HTTP requests to arbitrary URLs, leveraging the server's network access. In contrast, command injection involves injecting operating system commands directly into a system call executed by the application, typically through user input that is not properly sanitized. These are fundamentally different attack classes; SSRF manipulates URL fetching, while command injection manipulates shell execution, meaning an SSRF vulnerability does not inherently lead to command injection.

• ✓

  Access the cloud instance metadata to obtain temporary credentials

  Why this is correct

  This is the most common and impactful exploitation path for SSRF when targeting cloud environments. Cloud providers like AWS, GCP, and Azure expose local metadata services (e.g., http://169.254.169.254 for AWS EC2) that provide critical information about the running instance, including temporary security credentials (IAM roles), network configuration, and user data. By leveraging SSRF to access these endpoints, an attacker can obtain sensitive credentials, potentially escalating privileges and gaining access to other cloud resources.

• ✗

  Perform a denial-of-service attack on the internal network

  Why it's wrong here

  While an SSRF vulnerability could theoretically be used to initiate a denial-of-service attack by repeatedly targeting a vulnerable or resource-constrained internal service, a single request to a cloud metadata endpoint is primarily an information gathering attempt. The 169.254.169.254 address is designed for data retrieval, not for overwhelming a service. DoS attacks typically require sustained, high-volume traffic or specific resource exhaustion techniques that are not implied by merely accessing a metadata URL.

• ✗

  Perform a port scan on the internal network

  Why it's wrong here

  SSRF can indeed be a powerful tool for internal network reconnaissance, allowing an attacker to probe for open ports on internal hosts by observing connection responses (e.g., timeouts versus immediate refusals). However, the specific target http://169.254.169.254 is not a random internal IP for scanning. It is the well-known, dedicated IP address for cloud instance metadata services, indicating a direct intent to retrieve specific instance-related data rather than performing a general port scan across a network segment.

Go deeper

Related to this question