Mini-game · Chapter 5

SSRF Lab

You have RCE-equivalent access through a vulnerable URL fetcher on a server hosted in AWS. Your goal each round: read the cloud metadata at http://169.254.169.254/latest/meta-data/iam/security-credentials/web-role and exfiltrate the IAM credentials. The filter gets stronger each round.

Educational training material. This game demonstrates an attack technique inside a sandboxed quiz UI for security learning. Do not apply these techniques against systems you do not own or have explicit written permission to test.

Round 1 / 3 Score 0 Tries 0 Time 00:00