webProeasy
CloudPulse
hackadvisor
Task: authenticated CloudPulse dashboard exposed a webhook test feature that fetched attacker-supplied URLs from the server. Solution: abuse SSRF to enumerate an internal metadata service on 127.0.0.1:3001 and extract the IAM credential document containing the real flag in SecretAccessKey.
$ ls tags/ techniques/
credential_extractionssrf_exploitationmetadata_enumeration
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 97 — UptimePulse — SSRF Chain to RCE via Cloud Metadata— hackadvisor
- [web][Pro]Lab 104 — CloudOps Copilot — AI SSRF via Infrastructure Tool Abuse— hackadvisor
- [web][Pro]Lab 322 — NetPulse — IP Spoofing to RCE via Polling Agent API— hackadvisor
- [web][Pro]Lab 92 — EventPulse — SSRF via IPv6 Bypass in Webhook Verification— hackadvisor
- [web][Pro]MailPulse— hackadvisor