During an engagement, a penetration tester runs a command and receives the following output: Which of the following is the most likely reason the penetration tester received the output above?

The correct answer is B. The application queried the cloud provider metadata service and showed the results. The output shows a set of AWS credentials (AccessKeyId, SecretAccessKey, and Token), which are often retrieved from the cloud provider's instance metadata service. The metadata service is including security credentials for IAM roles attached to the instance. The penetration…

Attacks and Exploits

Question

During an engagement, a penetration tester runs a command and receives the following output:

Which of the following is the most likely reason the penetration tester received the output above?

Exhibit

Options

AThe application queried an internal database service and showed the results.
BThe application queried the cloud provider metadata service and showed the results.
CThe application accessed a file on its filesystem and displayed its content.
DThe application could not handle the request and displayed an error message.

How the community answered

(44 responses)

A
2% (1)
B
75% (33)
C
7% (3)
D
16% (7)

Explanation

The output shows a set of AWS credentials (AccessKeyId, SecretAccessKey, and Token), which are often retrieved from the cloud provider's instance metadata service. The metadata service is including security credentials for IAM roles attached to the instance. The penetration tester likely exploited a Server-Side Request Forgery (SSRF) vulnerability by manipulating the parameter pdfapi to direct the application to query the metadata endpoint As a result, the application fetched the IAM credentials from the metadata service and returned them in the response.

Topics

#Cloud Security#Server-Side Request Forgery (SSRF)#Cloud Metadata Service#Penetration Testing

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice