Server-Side Request Forgery (SSRF) WAHS Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is a common manual testing technique to detect SSRF?

   • AChecking if the server responds with a 404 error for invalid URLs.
   • BSending a large number of requests to the server to see if it crashes.
   • CInjecting SQL into the URL parameter to see if the database returns an error.
   • DSubmitting a URL that points to a collaborator or request bin and observing if the server makes a request.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An attacker exploits an SSRF vulnerability in a web application to access the cloud metadata service. Which of the following is the most likely direct impact?

   • AThe attacker can launch a denial-of-service attack against the metadata service.
   • BThe attacker can directly modify the web application's source code on the server.
   • CThe attacker can retrieve temporary security credentials associated with the instance's IAM role.
   • DThe attacker can take over the cloud account by changing the root password.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the most effective defense against SSRF when the application must fetch URLs from user input?

   • ABlocking requests to localhost and private IP ranges.
   • BEncoding user input before using it in the URL.
   • CValidating that the URL starts with http:// or https://.
   • DUsing an allowlist of permitted domains or IP addresses.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is a common entry point for SSRF vulnerabilities?

   • AAn HTTP header that sets the content type of the response.
   • BA cookie that stores the user's preferred language.
   • CA hidden form field that stores the user's session token.
   • DA URL parameter that the server uses to fetch a remote resource.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A web application allows users to upload an image from a URL. The application fetches the URL server-side. You are tasked with implementing SSRF defenses. You have the following constraints: the feature must support any public HTTP/HTTPS URL, and you cannot use a commercial WAF. Which of the following is the most effective defense?

   • ARestrict the feature to a list of approved domains.
   • BImplement a client-side check that only allows URLs with the 'https://' prefix.
   • CResolve the hostname to an IP address, verify it is not in a private or link-local range, and then fetch the URL using that IP address.
   • DUse a blocklist of known internal IP ranges and metadata endpoints.
   Reveal Solution Discussion Select an answer first