312-50V10 · Question #925
Jason, an attacker, targeted an organization to perform an attack on its Internet-facing web server with the intention of gaining access to backend servers, which are protected by a firewall. In this
The correct answer is B. Server-side request forgery (SSRF) attack. This is a Server-Side Request Forgery (SSRF) attack. In SSRF, the attacker manipulates a URL parameter (here, the 'url' parameter in 'feed.php?url=...') to make the target web server perform HTTP requests on the attacker's behalf. By changing the URL value from an external site t
Question
Jason, an attacker, targeted an organization to perform an attack on its Internet-facing web server with the intention of gaining access to backend servers, which are protected by a firewall. In this process, he used a URL https://xyz.com/feed.php?url:externaIsile.com/feed/to to obtain a remote feed and altered the URL input to the local host to view all the local resources on the target server. What is the type of attack Jason performed In the above scenario?
Options
- Awebsite defacement
- BServer-side request forgery (SSRF) attack
- CWeb server misconfiguration
- Dweb cache poisoning attack
How the community answered
(51 responses)- A2% (1)
- B80% (41)
- C12% (6)
- D6% (3)
Explanation
This is a Server-Side Request Forgery (SSRF) attack. In SSRF, the attacker manipulates a URL parameter (here, the 'url' parameter in 'feed.php?url=...') to make the target web server perform HTTP requests on the attacker's behalf. By changing the URL value from an external site to 'localhost' or internal IP ranges (e.g., 127.0.0.1), Jason tricks the server into fetching its own internal resources - bypassing the firewall that protects backend servers from direct external access. The server, trusted by the internal network, becomes a proxy for the attacker. This is distinct from web cache poisoning (which manipulates cached responses) or website defacement (which alters visible content).
Topics
Community Discussion
No community discussion yet for this question.