CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Cross-Site Scripting (XSS) via uploaded file

  Why this is correct

  Cross-Site Scripting (XSS) via uploaded file occurs when an attacker uploads malicious client-side script, typically JavaScript, to a web-accessible resource like a public AWS S3 bucket. If the bucket is configured to serve the file with an executable Content-Type (e.g., text/html or application/javascript) and a user's browser accesses this file directly, the script executes within the user's browser context. This allows the attacker to steal session cookies, deface the page, or redirect users, leveraging the trust in the S3 domain.

• ✗

  Server-Side Request Forgery (SSRF)

  Why it's wrong here

  Server-Side Request Forgery (SSRF) involves an attacker tricking a server-side application into making HTTP requests to an arbitrary domain of the attacker's choosing, often targeting internal network resources or cloud metadata services. In this scenario, the attack vector is client-side, where malicious JavaScript executes within the end-user's browser after accessing an uploaded file from S3. The S3 server itself is not coerced into making unauthorized requests, distinguishing this from a true SSRF vulnerability.

• ✗

  Insecure Direct Object Reference (IDOR)

  Why it's wrong here

  Insecure Direct Object Reference (IDOR) vulnerabilities arise when an application exposes a direct reference to an internal implementation object, such as a file or database key, and fails to verify user authorization to access that object. The described attack leverages a publicly accessible S3 bucket to serve malicious content, meaning the bucket itself and the uploaded object are intentionally accessible to all. The issue is with the content's malicious nature, not unauthorized access to other private objects via predictable identifiers, which is the hallmark of IDOR.

• ✗

  S3 bucket privilege escalation

  Why it's wrong here

  S3 bucket privilege escalation refers to an attacker gaining higher-level AWS Identity and Access Management (IAM) permissions than initially authorized, for instance, escalating from read-only access to full administrative control over an S3 bucket or other AWS services. While serving malicious content from a public S3 bucket is a significant security flaw, it does not inherently grant the attacker elevated permissions within the AWS environment. The attack exploits existing public access settings to impact end-users, rather than modifying the attacker's AWS privileges.

Go deeper

Related to this question