Resecurity | SSRF to AWS Metadata Exposure: How Attackers Steal Cloud ...

Attackers can exploit SSRF to access the EC2 Instance Metadata Service at 169.254.169.254, retrieving temporary IAM credentials. This allows them to impersonate the instance and interact with AWS services (e.g., download S3 data, list EC2 instances).

Exploiting Cloud Metadata via SSRF: 169.254.169.254 on AWS, GCP, and Azure

How SSRF turns into stolen cloud credentials through the 169.254.169.254 metadata endpoint. IMDSv1 vs IMDSv2, the GCP header requirement, Azure quirks, and why IMDSv2 still gets popped.

Cloud SSRF - HackTricks

The instance metadata endpoint is accessible from an EC2 instance at http://169.254.169.254 and exposes information about that instance ( metadata...

Steal EC2 Metadata Credentials via SSRF - Hacking The Cloud

Old faithful; How to steal IAM Role credentials from the EC2 Metadata service via SSRF.

SSRF and Cloud Metadata — Block Server-Side Forgery

The cloud turns SSRF from reconnaissance into takeover through the instance metadata service. Cloud platforms expose internal data about each virtual machine at a fixed link-local address — 169.254.169.254 on AWS, Azure, and GCP (with platform-specific paths).

SSRF Cloud Metadata: From Bug to Account Takeover - CyberXplore - Blog

SSRF cloud metadata attacks turn a URL fetcher into IAM credential theft. See how attackers reach 169.254.169.254 and how IMDSv2 plus egress rules stop it.

SSRF in Cloud Metadata Services: Complete Security Guide

SSRF against cloud metadata services tricks a server into querying the internal 169.254.169.254 endpoint to obtain temporary cloud credentials.

SSRF to Cloud Metadata Exploitation - cybersecpentesting.com

On-premise SSRF is serious. In cloud environments, it becomes catastrophic. Every major cloud provider exposes a non-routable metadata service at a link-local address (169.254.169.254 on AWS and GCP, with Azure sharing the same IP historically). This endpoint is accessible only from within the instance and requires no authentication on IMDSv1.

A complete conquest of SSRF attacks [2026]: cloud-metadata theft, blind ...

An in-depth look at server-side request forgery (SSRF) attack techniques, faithful to the PortSwigger Web Security Academy. Reaching the server itself (localhost) and internal systems, stealing credentials from the cloud-metadata endpoint (169.254.169.254), bypassing blacklist/whitelist filters, bypass via an open redirect, OAST detection of blind SSRF where no response returns, and root-cause ...

Cloud Metadata SSRF: AWS IMDSv2, GCP, Azure (2026)

Cloud metadata SSRF is a server-side request forgery bug that makes a workload fetch its cloud provider's metadata endpoint (169.254.169.254 on AWS and Azure, metadata.google.internal on GCP) and return the temporary IAM credentials attached to it.