thinQtankLABS

SSRF Detection & Incident Response

Respond to a Server-Side Request Forgery compromise (CWE-918) where a web app's URL-fetch feature was aimed at the cloud metadata endpoint and leaked IAM credentials. Reconstruct the timeline from the access and fetch logs, scope the credential exposure, engineer a detection rule for fetches aimed at internal/link-local targets (tuned past a benign look-alike), then contain with an allowlist, rotate the exposed credentials, verify and report.

Intermediate 21 guided steps 6 tasks About 75 minutes Runs in your browser

Skills you will practice

  • Log analysis
  • detection and IR; Incident-handling lifecycle; SSRF detection and IOCs; Cloud credential exposure response; Security Operations domain

Certifications this lab maps to

This lab builds hands-on skills that appear on these certification exams. thinQtank Learning runs instructor-led training camps for each — click one to see upcoming classes.

CompTIA CySA+ CS0-003 Log analysis, detection and IR Training at thinQtank Learning EC-Council Certified Ethical Hacker CEH Web attack techniques and IOCs Training at thinQtank Learning EC-Council Certified Incident Handler E|CIH Incident-handling lifecycle Training at thinQtank Learning ISC2 CISSP CISSP Security Operations domain Training at thinQtank Learning
Part of these certification lab packages: CySA+ CS0-003 PenTest+ PT0-003 CISSP Certified Ethical Hacker (CEH) CEH Certified Incident Handler (E|CIH) E|CIH GCIH GCIH GPEN GPEN GCIA GCIA

The scenario

A Acme Portal host (CWE-918 open in the Import from URL feature) logged fetch requests aimed at internal and metadata addresses, and the instance credentials were then used from a new IP. You are the responder.

What you will do

  1. Open and classify the incident4 steps

    Open the incident · Read the alert · Read the ticket · Classify it

  2. Reconstruct the timeline3 steps

    Pull the attacker's requests · Correlate the fetch log · What is the impact?

  3. Scope the exposure3 steps

    Inspect the triage capture · What must be rotated? · Record IOCs

  4. Engineer a detection rule4 steps

    Study the sample · Write a rule · Test and tune · Why key on the target address?

  5. Contain, eradicate, verify5 steps

    Contain: lock down the fetch feature · Eradicate: rotate the exposed credentials · Verify the host · Confirm detection holds · …

  6. Report2 steps

    Write the report · Why rotate, not just fix?

How this lab works

A real Linux-style console. Commands run against real files, so hashes, hex dumps and comparisons give real results.

A file browser where you can place evidence into the lab, either the file provided or one of your own.

Reset a single step, a whole task or the entire lab. The environment is rebuilt so you can try again cleanly.

Progress saves after every step. Close the tab and come back later; your files and answers are waiting.