During a short, controlled security assessment of an educational institution's network, I encountered a scenario that perfectly demonstrates a common misconception in cybersecurity:

A strong perimeter does not guarantee strong security.

On paper, this environment was locked down exceptionally well. Firewalls were hardened, authentication was enforced, and common attack paths were dead on arrival. Yet a single application-level flaw quietly bypassed all of it.

This post walks through what was tested, what worked, and why one overlooked vulnerability still mattered.

The Target Environment

  • Device: Ubiquiti UniFi Dream Machine Pro (UDM Pro)
  • Gateway IP: 192.168.1.1
  • Network Range: 192.168.1.0/24
  • Assessment Type: Grey-box
  • Duration: ~2 hours

This was an educational, non-destructive assessment focused strictly on defensive validation.

First Impressions: A Well-Defended Network

Initial reconnaissance showed exactly what you'd expect from a properly managed UniFi deployment.

Open Services (Expected & Controlled)

nmap -p 1-65535 192.168.1.1

Services exposed were consistent with UniFi OS components:

  • HTTPS management interfaces
  • UniFi Protect
  • Internal application services (Tomcat-based)
  • DNS via dnsmasq

No unnecessary legacy services. No obvious misconfigurations.

Service & Authentication Testing

Further inspection confirmed:

  • HTTPS enforced everywhere
  • No default credentials
  • Token-based authentication required
  • SSO lockout protections are active
  • No accessible admin or debug endpoints

Every obvious path failed cleanly:

  • /api/auth/login > 401
  • /api/token > 401
  • Protect APIs > Token required
  • Tomcat > No default pages, no manager access

From a traditional network and authentication standpoint, this environment was solid.

MITM & Network-Level Attacks: Blocked

I attempted a standard ARP spoofing attack to evaluate layer 2 defenses.

sudo ettercap -T -i en0 -M arp /192.168.1.1// /victim//

Results:

  • ARP poisoning was partially attempted
  • DNS queries observed
  • No HTTP/HTTPS traffic intercepted (Encrypted/Protected)
  • The Gateway MAC address remained stable

UDM Pro successfully defended against ARP spoofing attacks, likely through:

  • Static ARP entries
  • ARP inspection
  • IPS/IDS enforcement

Again, exactly what you want to see.

So What Was the Problem?

At this point, it would be easy to conclude:

"This network is secure."

And from a network engineering perspective, that's mostly true.

But security doesn't end at the firewall.

The SSRF That Changed Everything

A public-facing application within the environment contained a Server-Side Request Forgery (SSRF) vulnerability.

This allowed an unauthenticated external attacker to coerce the server into making arbitrary requests to internal-only services.

Why This Matters

Even with:

  • Firewalls
  • VLAN segmentation
  • Locked-down admin interfaces
  • IPS protections

The application itself became a trusted proxy inside the network.

Impact

  • Internal services became reachable indirectly
  • Network segmentation was effectively bypassed
  • Security controls were rendered irrelevant for that attack path

This wasn't a failure of UniFi. It wasn't a firewall issue. It wasn't bad authentication.

It was an application-layer trust violation.

The Key Lesson

Perimeter security only protects what applications don't undermine.

You can have:

  • Perfect firewall rules
  • Excellent authentication
  • Strong IDS/IPS coverage

And still lose if a single application is allowed to:

  • Fetch arbitrary URLs
  • Resolve internal IPs
  • Access cloud metadata or internal APIs

Why This Happens So Often

SSRF vulnerabilities are frequently underestimated because:

  • They don't "look" like RCE
  • They often return subtle responses
  • They exploit trust, not bugs

But in modern environments, SSRF is often the first domino in:

  • Internal service discovery
  • Credential harvesting
  • Cloud compromise
  • Full environment takeover

Final Thoughts

This assessment wasn't a failure; it was a success.

It proved that:

  • The network was configured correctly
  • Defensive controls were effective
  • Monitoring was active

And it highlighted the one area that still needed attention:

Applications must be treated as part of the perimeter.

Security isn't about having no vulnerabilities. It's about understanding which ones invalidate everything else.