PT0-003 · Question #161
A penetration tester is performing a cloud-based penetration test against a company. Stakeholders have indicated the priority is to see if the tester can get into privileged systems that are not…
The correct answer is E. Leverage the SSRF to gain access to credentials from the metadata service. Server-side request forgery (SSRF) vulnerabilities allow attackers to force a server to send requests to internal resources. In cloud environments, SSRF can often be used to access the metadata service (e.g., AWS EC2 metadata) to retrieve credentials for cloud services. Once…
Question
A penetration tester is performing a cloud-based penetration test against a company. Stakeholders have indicated the priority is to see if the tester can get into privileged systems that are not directly accessible from the internet. Given the following scanner information:
- Server-side request forgery vulnerability in test.comptia.org
- Reflected cross-site scripting vulnerability in test2.comptia.org
- Publicly accessible storage system named static_comptia_assets
- SSH port 22 open to the internet on test3.comptia.org
- Open redirect vulnerability in test4.comptia.org
Which of the following of the attack paths should the tester prioritize first?
Options
- ASynchronize all the information from the public bucket and scan it with Trufflehog.
- BRun Pacu to enumerate permissions and roles within the cloud-based systems.
- CPerform a full dictionary brute-force attack against the open SSH service using Hydra.
- DUse the reflected cross-site scripting attack within a phishing campaign to attack administrators.
- ELeverage the SSRF to gain access to credentials from the metadata service.
How the community answered
(31 responses)- A3% (1)
- B10% (3)
- C6% (2)
- D23% (7)
- E58% (18)
Explanation
Server-side request forgery (SSRF) vulnerabilities allow attackers to force a server to send requests to internal resources. In cloud environments, SSRF can often be used to access the metadata service (e.g., AWS EC2 metadata) to retrieve credentials for cloud services. Once credentials are obtained, they can be used to access privileged systems that are not directly accessible from the internet.
Topics
Community Discussion
No community discussion yet for this question.