webProeasy

CloudPulse

hackadvisor

Task: authenticated CloudPulse dashboard exposed a webhook test feature that fetched attacker-supplied URLs from the server. Solution: abuse SSRF to enumerate an internal metadata service on 127.0.0.1:3001 and extract the IAM credential document containing the real flag in SecretAccessKey.

$ ls tags/ techniques/
credential_extractionssrf_exploitationmetadata_enumeration

🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups