What type of attack forces a server to make requests to internal or unintended resources, potentially exposing cloud metadata or internal databases?

• A. Server-Side Request Forgery (SSRF)
• B. Cross-Site Scripting
• C. SQL Injection
• D. Cross-Site Request Forgery

Answer: (A)

Server-Side Request Forgery is about tricking a vulnerable application into making requests from its own server to other resources, often using user-supplied input as the target URL. The attacker exploits this to reach internal or unintended endpoints, which can reveal sensitive data such as cloud instance metadata or access to internal databases that aren’t accessible directly from the outside. The key idea is that the server, acting on behalf of the attacker, becomes the conduit to internal resources rather than the attacker querying them directly.

Other flaws involve different ideas: XSS injects scripts that run in a victim’s browser, SQL injection manipulates database queries, and CSRF coerces an authenticated user’s browser into performing unwanted actions. None of these force the server to reach internal resources in the way SSRF does.