CEH Web Application and Injection Attacks Practice Question
An attacker attempts to exploit a web application by sending a request that triggers the server to make an internal HTTP request to a sensitive internal service. Which type of attack is this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSRF
SSRF (Server-Side Request Forgery) occurs when an attacker can induce the server to make requests to internal resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
CSRF
Why it's wrong here
Cross-Site Request Forgery (CSRF) is an attack where a malicious website, email, or program tricks a user's web browser into performing an unwanted action on a trusted site where the user is currently authenticated. The request originates from the *user's browser* leveraging their session cookies, not from the server itself making requests to other systems. This attack aims to manipulate user actions, such as changing passwords or transferring funds, by exploiting trust in the user's browser.
- ✗
XXE
Why it's wrong here
XML External Entity (XXE) injection exploits vulnerabilities in XML parsers that process user-supplied XML input containing external entity declarations. Attackers can leverage this to read arbitrary files on the server's filesystem, perform Server-Side Request Forgery (SSRF) by making the server request internal or external resources, or even execute denial-of-service attacks. While XXE can be a *vector* for SSRF, the core attack described in the question, where the server makes unintended requests, is the definition of SSRF itself, not the XML parsing vulnerability.
- ✓
SSRF
Why this is correct
Server-Side Request Forgery (SSRF) occurs when a web application is tricked into making requests to an arbitrary domain specified by an attacker. This vulnerability allows an attacker to induce the server-side application to make HTTP requests to an attacker-specified location, potentially targeting internal networks, cloud metadata services, or other external systems. The server acts as a proxy for the attacker, bypassing network segmentation or firewall rules that might otherwise block direct access.
- ✗
IDOR
Why it's wrong here
Insecure Direct Object Reference (IDOR) vulnerabilities arise when an application exposes a direct reference to an internal implementation object, such as a file, database record, or directory, and fails to verify if the user is authorized to access that object. An attacker can manipulate these identifiers in URLs or parameters to access or modify resources belonging to other users without proper authorization. This attack focuses on unauthorized data access or manipulation through identifier modification, not on coercing the server to initiate new requests to external or internal systems.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An application is vulnerable to server-side request forgery (SSRF). An attacker exploits this to access internal services. Which of the following is a common indicator of SSRF?
medium- A.The application uses user input in file inclusion functions like include()
- ✓ B.The application includes a parameter like 'url=' that fetches remote resources
- C.The application reflects user input in HTTP headers
- D.The application stores user input in a database without sanitization
Why B: SSRF vulnerabilities often appear where the application fetches URLs based on user input, such as 'url=' parameters, allowing the attacker to make the server request internal resources.
Variation 2. A web application is vulnerable to server-side request forgery (SSRF). An attacker sends a request that causes the server to make an internal HTTP request to http://169.254.169.254/latest/meta-data/. What is the attacker attempting to achieve?
medium- A.Exploit a command injection vulnerability in the web server
- ✓ B.Access the cloud instance metadata to obtain temporary credentials
- C.Perform a denial-of-service attack on the internal network
- D.Perform a port scan on the internal network
Why B: 169.254.169.254 is the metadata IP address for cloud providers like AWS. The attacker is trying to retrieve instance metadata, which may contain credentials (e.g., IAM role credentials).
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.