Exploit server-side request forgery

Exploit SSRF to reach cloud metadata and internal services

AWS/GCP credential theft via IMDSv1 metadata endpoint and internal database access

• · target_endpoint (avatar URL, webhook, proxy)
• · payload (file://, gopher://, cloud metadata IP)

• · credentials_stolen (IAM tokens, API keys)
• · internal_data (database contents, private files)

• · HTTP client
• · Burp Intruder or curl with payload list

SSRF endpoint confirmed, internal network structure known, permission to test

• · Firewall blocks internal requests
• · Cloud metadata service disabled (IMDSv2)
• · URL validation bypasses exhausted
• · OOB channel blocked

• · Cloud metadata endpoint (169.254.169.254:80/latest/meta-data/iam/security-credentials/)
• · Filter bypass payloads (@ double encoding, //, etc.)
• · Gopher protocol for Redis/Memcached exploitation