How can an attacker use redirects to exploit SSRF?

By using a redirect to increase the speed of the request.

By redirecting the server's request to a different protocol, such as file://.

By redirecting the request to a public server to hide the attacker's identity.

By providing a URL that redirects to an internal address, bypassing filters that only check the initial URL.

A web application allows users to submit a URL to fetch a preview image. The application performs the request server-side and displays the returned content. During a security review, you want to determine whether the application is vulnerable to SSRF. Which test would most directly confirm the vulnerability without causing harm?

Submit a URL pointing to http://127.0.0.1:8080/admin and observe whether the response contains internal admin content.

Submit a URL using the file:// protocol and see if the application returns the contents of a local file.

Submit a URL with a very long string to see if the application truncates the input.

Submit a URL to an external site you control and check the access logs for the server's IP address.

How can SSRF be used to access local files on the server?

By using the ftp:// protocol to connect to the local FTP server.

By sending a request to http://localhost:80/.

By using the file:// protocol in the SSRF payload.

By using the gopher:// protocol to send raw TCP packets.

What is a common internal resource that an attacker might target with SSRF?

The cloud metadata service at 169.254.169.254.

The router's default gateway at 192.168.1.1.

The public web server at example.com.

In an SSRF attack, why does the attacker want the server to make the request instead of making it directly?

To hide the attacker's IP address from the target server.

To increase the speed of the request by using the server's faster internet connection.

To bypass client-side security controls like Content Security Policy.

To leverage the server's network position and trust level to access internal resources.

EC-CouncilWeb Application Hacking and Security

Domain 4Objective 2

Server-Side Request Forgery (SSRF) WAHS Practice Questions (Page 1)

Part of the Request Forgery Attacks domain, which makes up ~6% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

7concepts

Questions 1–5

1foundation · easy
How can an attacker use redirects to exploit SSRF?
Select an answer first
2application · medium
A web application allows users to submit a URL to fetch a preview image. The application performs the request server-side and displays the returned content. During a security review, you want to determine whether the application is vulnerable to SSRF. Which test would most directly confirm the vulnerability without causing harm?
Select an answer first
3foundation · easy
How can SSRF be used to access local files on the server?
Select an answer first
4foundation · easy
What is a common internal resource that an attacker might target with SSRF?
Select an answer first
5foundation · easy
In an SSRF attack, why does the attacker want the server to make the request instead of making it directly?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.