CEH SSRF (Server-Side Request Forgery) Practice Question

Which THREE of the following are valid methods to exploit or test for Server-Side Request Forgery (SSRF)?

⚠ Common exam trap

Candidates often think SSRF only involves HTTP requests to internal IPs, but the file:// protocol is equally valid and commonly tested.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Using the file:// protocol to read local files

SSRF (Server-Side Request Forgery) can be exploited by making the server fetch internal resources. Common techniques include using the file:// protocol to read local files (e.g., /etc/passwd), accessing internal services via localhost (e.g., http://127.0.0.1/admin), and targeting cloud metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/). Options B, C, and E are all valid SSRF techniques.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Injecting SQL commands into input fields
Why it's wrong here
Injecting SQL commands into input fields constitutes a SQL injection vulnerability. This attack specifically targets the application's database, manipulating backend queries to extract or modify data. It does not involve coercing the server to make arbitrary requests to other internal or external resources, which is the defining characteristic of Server-Side Request Forgery (SSRF).
✓
Using the file:// protocol to read local files
Why this is correct
Utilizing the file:// protocol within an SSRF vulnerability allows an attacker to force the vulnerable server to read local files from its own filesystem. By supplying a URL like file:///etc/passwd or file:///C:/Windows/System32/drivers/etc/hosts, the server processes this internal URI, retrieves the specified file's content, and potentially returns it in the application's response. This method directly exploits the server's ability to handle local file system requests.
✓
Submitting a URL pointing to http://127.0.0.1/admin
Why this is correct
Submitting a URL pointing to http://127.0.0.1/admin is a fundamental SSRF technique to test for internal service access. The 127.0.0.1 loopback address refers to the server itself, allowing an attacker to force the vulnerable application to make requests to services running locally on the same machine. This can expose internal administrative interfaces, unauthenticated APIs, or other services not intended for external access, demonstrating the server's susceptibility to internal network requests.
✗
Sending a payload that includes <script>alert(1)</script>
Why it's wrong here
Sending a payload containing <script>alert(1)</script> is characteristic of a Cross-Site Scripting (XSS) attack. XSS vulnerabilities occur when an application embeds untrusted data into a web page without proper sanitization, causing malicious scripts to execute within the victim's browser. This attack vector primarily impacts client-side users and does not involve the server making unauthorized requests to other internal or external systems, distinguishing it from SSRF.
✓
Submitting a URL targeting http://169.254.169.254/latest/meta-data/
Why this is correct
Submitting a URL targeting http://169.254.169.254/latest/meta-data/ is a highly effective SSRF exploitation method, particularly in cloud environments like AWS. This specific IP address is a non-routable link-local address used by cloud instances to access their own metadata service. An SSRF vulnerability allows an attacker to coerce the server into requesting this internal endpoint, potentially revealing sensitive information such as IAM role credentials, instance profiles, and network configurations.

Go deeper

CEH SSRF (Server-Side Request Forgery) Practice Question

Why each option matters

Option-by-option breakdown

Related to this question