CEH Web Application and Injection Attacks Practice Question
An application is vulnerable to server-side request forgery (SSRF). An attacker exploits this to access internal services. Which of the following is a common indicator of SSRF?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The application includes a parameter like 'url=' that fetches remote resources
SSRF vulnerabilities often appear where the application fetches URLs based on user input, such as 'url=' parameters, allowing the attacker to make the server request internal resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The application uses user input in file inclusion functions like include()
Why it's wrong here
When an application incorporates unsanitized user input directly into file inclusion functions like `include()` or `require()`, it becomes vulnerable to Local File Inclusion (LFI). This allows an attacker to read or execute arbitrary files present on the server's local filesystem, potentially leading to information disclosure or remote code execution. However, LFI specifically targets local files and does not inherently involve the server making outbound requests to other network resources, which is the defining characteristic of Server-Side Request Forgery (SSRF).
- ✓
The application includes a parameter like 'url=' that fetches remote resources
Why this is correct
An application that includes a parameter, such as 'url=' or 'resource=', which the server then uses to fetch content from a user-supplied remote address, is a classic indicator of a Server-Side Request Forgery (SSRF) vulnerability. This allows an attacker to manipulate the server into making requests to arbitrary internal or external network resources on their behalf. Such a mechanism enables the server to act as a proxy, potentially accessing internal systems, cloud metadata APIs, or bypassing firewall rules that would otherwise block direct access from the attacker.
- ✗
The application reflects user input in HTTP headers
Why it's wrong here
If an application reflects user-controlled input directly into HTTP response headers without proper sanitization, it is susceptible to HTTP Header Injection. This vulnerability allows an attacker to inject arbitrary header fields, potentially leading to issues like Cross-Site Scripting (XSS) via header manipulation, cache poisoning, or session fixation. Unlike SSRF, which involves the server initiating new outbound network connections based on user input, header injection primarily manipulates the headers of the HTTP response being sent back to the client or to an intermediary proxy.
- ✗
The application stores user input in a database without sanitization
Why it's wrong here
When an application stores user input directly into a database without adequate sanitization or validation, it creates vulnerabilities such as Stored Cross-Site Scripting (XSS) or SQL Injection. Stored XSS occurs when malicious scripts are retrieved from the database and executed in other users' browsers, while SQL Injection allows attackers to manipulate database queries. These vulnerabilities focus on data persistence and database interaction or client-side script execution, fundamentally differing from Server-Side Request Forgery (SSRF), which exploits the server's ability to make outbound network requests.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.