# Advanced Server-Side Attacks

> SSRF to cloud metadata, deserialization gadget chains, path traversal and file inclusion, race condition exploitation, and prototype pollution to RCE.

- **URL:** https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/advanced-server-side-attacks
- **Certification:** [PT2 (Penetration Tester Level 2) Study Path](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path.md)
- **Estimated study hours:** 12
- **Published:** 2026-10-04
- **Updated:** 2026-10-04

Server-side attacks exploit the way an application processes input the server itself trusts. The surface is wide: URLs the backend fetches on behalf of the user, serialized objects the application rebuilds from a cookie, file paths derived from parameters, data races between concurrent requests, and JavaScript object prototypes shared across the entire runtime. PT2 tests whether you can take any of them from a quiet primitive to RCE or sensitive-data exfiltration.

## SSRF And Cloud Metadata

SSRF turns the server into a proxy for the attacker. The highest-impact chain is AWS IMDS at `169.254.169.254`: scrape the IAM role name, pull short-lived credentials, and act as that role across every service it is attached to. GCP and Azure expose equivalent metadata endpoints. Beyond the cloud, SSRF reaches internal admin panels, scans internal networks, and (via gopher) smuggles arbitrary bytes into unauthenticated internal services.

## Deserialization

Serialized data a user controls, deserialized by the server, becomes code execution when a gadget chain exists in the application's dependencies. `ysoserial` for Java, `phpggc` for PHP, and `ysoserial.net` for .NET maintain curated chains per common library. Python pickle and YAML `!!python/object` are even more direct: both deserialize arbitrary callables by default. ViewState, JSON.NET `TypeNameHandling`, and `BinaryFormatter` are the usual .NET entry points.

## Path Traversal And File Inclusion

Any parameter that references a file is a candidate. Traversal reads sensitive files (`/etc/passwd`, `/etc/shadow`, framework config); file inclusion goes further and executes code when the included file is interpreted (PHP, JSP, templating engines). Filter bypasses stack: URL encoding, double encoding, nested sequences, absolute paths, and null-byte truncation on older runtimes.

## Race Conditions

Business logic that checks state and then acts on it is vulnerable when two requests overlap between the check and the act. HTTP/2 single-packet attacks collapse the request window to microseconds. Classic targets: coupon redemption, balance withdrawals, vote counting, invite acceptance, account creation uniqueness.

## Prototype Pollution

A client-side quirk that becomes server-side RCE when polluted properties flow into `child_process.spawn`, EJS template rendering, or access-control checks. Vulnerable library versions (`lodash`, `minimist`, `set-value`) are the entry points to look for.

## Chaining

Server-side primitives chain horizontally: SSRF to IMDS to cloud account takeover; path traversal to source leak to deserialization gadget discovery; prototype pollution to RCE through the templating engine. The exam rewards finding the primitive, then asking what each one unlocks downstream.

## Study material

- [SSRF Detection](https://hackindex.io/services/web/vulnerability-discovery/ssrf-detection.md) (read, core)
- [SSRF Exploitation](https://hackindex.io/services/web/exploitation/ssrf-exploitation.md) (read, core)
- [Insecure Deserialization](https://hackindex.io/services/web/exploitation/insecure-deserialization.md) (read, core)
- [Directory Traversal Detection](https://hackindex.io/services/web/vulnerability-discovery/directory-traversal-detection.md) (read, core)
- [Directory Traversal](https://hackindex.io/services/web/exploitation/directory-traversal.md) (read, core)
- [File inclusion](https://hackindex.io/services/web/vulnerability-discovery/file-inclusion.md) (read, core)
- [Race Condition Exploitation](https://hackindex.io/services/web/exploitation/race-condition-exploitation.md) (read, core)
- [Prototype Pollution](https://hackindex.io/services/web/exploitation/prototype-pollution.md) (read, core)