Abusing Reverse Proxies, Part 1: Metadata
Summary
Introduction Many cloud service providers offer a "metadata" service on their virtual machines. These services offer sensitive details about the instance and cloud operating environment. Metadata services offer REST APIs to programmatically retrieve this data. Amazon’s AWS service defined the IMDSv1 “standard” on their EC2 instances, and since then many others have adopted this IMDSv1 scheme as well, including AWS, Google, and Azure. The services have generally settled on the IP address 169.254
- Published
- Collected
--- id: 9312 title: "Abusing Reverse Proxies, Part 1: Metadata" source_domain: projectdiscovery.io source_url: "https://projectdiscovery.io/blog/abusing-reverse-proxies-metadata" published_at: "2022-01-17T08:38:29Z" tags: ["bug-bounty", "cloud"] phying_url: "https://phying.com/item/9312" lang: en --- # Abusing Reverse Proxies, Part 1: Metadata ## Summary Introduction Many cloud service providers offer a "metadata" service on their virtual machines. These services offer sensitive details about the instance and cloud operating environment. Metadata services offer REST APIs to programmatically retrieve this data. Amazon’s AWS service defined the IMDSv1 “standard” on their EC2 instances, and since then many others have adopted this IMDSv1 scheme as well, including AWS, Google, and Azure. The services have generally settled on the IP address 169.254 ## Intelligence Metadata - **Sources:** projectdiscovery.io - **Published:** 2022-01-17T08:38:29Z - **Original:** https://projectdiscovery.io/blog/abusing-reverse-proxies-metadata - **Phying News:** https://phying.com/item/9312