11.2 Lab: Exploiting XXE to perform SSRF attacks | 2023
The lab server is running a (simulated) EC2 metadata endpoint at the default URL, http://169.254.169.254/. To solve the lab, exploit the XXE vulnerability to perform an SSRF attack that obtains the server’s IAM secret access key from the EC2 metadata endpoint | Karthikeyan Nagaraj
This lab has a “Check stock” feature that parses XML input and returns any unexpected values in the response.
The lab server is running a (simulated) EC2 metadata endpoint at the default URL, which is
http://169.254.169.254/. This endpoint can be used to retrieve data about the instance, some of which might be sensitive.
- Visit a product page, click “Check stock”, and intercept the resulting POST request in Burp Suite.
- Insert the following external entity definition in between the XML declaration and the
3. Replace the
productId number with a
4. This makes a reference to the Entity we used on payload and displays the
5. Now you will able to see a word/path in the response
6. suffix the path at the end of the URL as here http://169.254.169.254/latest in the repeater and again repeat the process till you get the Secret Key
Repeat the request with the path we found on Each response
Learn Cyber Security and Create Awareness ~ cyberwing Stay tuned with me, Subscribe and Like the Videos... Ask Doubts…
If you would like to support me so that I could create more free content — https://www.buymeacoffee.com/cyberw1ng
Thank you for Reading!
Happy Hacking ~
Author: Karthikeyan Nagaraj ~ Cyberw1ng
Telegram Channel for Ethical Hacking Dumps — https://t.me/ethicalhackingessentials