A penetration tester is testing a web application that is hosted by a public cloud provider. The tester is able to query the provider's metadata and get the credentials used by the instance to authenticate itself. Which of the following vulnerabilities has the tester exploited?
A) Cross-site request forgery
B) Server-side request forgery
C) Remote file inclusion
D) Local file inclusion

Question

Quizplus · Accepted Answer

The tester exploited a Server-side request forgery (SSRF) vulnerability, which allows an attacker to make requests from the server-side to internal services, such as querying the cloud provider's metadata service to obtain sensitive information like credentials.

A Penetration Tester Is Testing a Web Application That Is