Research Update Enhanced src/pentesting-web/ssrf-server-side...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL:
• Blog Title: Research Update Enhanced src/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.md
• Suggested Section: Research

🎯 Content Summary

Research Update for src/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.md

This PR contains automated research updates including:

• Latest security vulnerabilities and attack vectors
• Updated techniques and tools
• Enhanced explanations and examples
• Additional references and resources

Generated by: HackTricks Research Agent
Timestamp: 2026-04-14 14:03:48 UTC

Tool usage

• apply_patch: 1
• brave_search: 2
• exec: 25
• search_google_web: 6
• task_steps_manager: ...

🔧 Technical Details

Research update for HackTricks content

🤖 Agent Actions

Reading the target page and adjacent SSRF content first. Then I’ll fan out into recent cloud SSRF research and fold only the pieces that add clear technical value without duplicating nearby HackTricks pages.
The target page already covers AWS EC2/ECS/Lambda/Elastic Beanstalk, GCP, DigitalOcean, and Azure, but some parts are dated. I’m checking nearby SSRF/cloud pages now to avoid re-adding generic material and to isolate what is actually missing.
I’ve isolated three likely high-signal gaps: newer AWS container credential flows, GCP identity-token usage from metadata in serverless, and some stale provider notes at the end of the page. I’m pulling primary-source details now so the additions stay precise instead of drifting into generic SSRF advice.
I have enough research to make targeted changes. The plan is to add one modern AWS container-credential path, one GCP serverless identity-token path, and replace the stale Oracle Cloud metadata note with current IMDSv2 behavior, then close with a minimal references section.
Editing the cloud SSRF page now. I’m keeping the existing structure intact and only inserting concrete provider-specific paths that materially improve the page: EKS Pod Identity, Cloud Run identity tokens, and current OCI IMDSv2 behavior.
Updated cloud-ssrf.md.

The changes were targeted rather than broad:

• Added a new AWS EKS Pod Identity section covering the newer AWS_CONTAINER_CREDENTIALS_FULL_URI / AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE flow and a practical credential-retrieval example against 169.254.170.23.
• Added a Cloud Run / Cloud Functions 2nd gen section showing both OAuth token theft and the more interesting audience-bound identity token abuse path via the metadata server.
• Replaced the stale Oracle Cloud note with current OCI IMDSv2 behavior, including the required Authorization: Bearer Oracle header and rejection of forwarded headers.
• Fixed minor AWS typos: crate -> create and AWS_ACCES_KEY_ID -> AWS_ACCESS_KEY_ID.
• Added a final ## References section with 2 relevant official references.

I verified the diff and checked that the file now ends with ## References.

Research URLs used:

• https://docs.aws.amazon.com/sdkref/latest/guide/feature-container-credentials.html
• https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-environment-variables.html
• https://docs.aws.amazon.com/eks/latest/userguide/pod-id-how-it-works.html
• https://docs.cloud.google.com/run/docs/authenticating/service-to-service
• https://docs.cloud.google.com/compute/docs/metadata/predefined-metadata-keys
• https://learn.microsoft.com/en-us/azure/app-service/overview-managed-identity
• https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/how-to-use-vm-token
• https://docs.oracle.com/en-us/iaas/Content/Compute/Tasks/gettingmetadata.htm
• https://securitylabs.datadoghq.com/articles/amazon-eks-attacking-securing-cloud-identities/

No further changes looked necessary without starting to duplicate generic SSRF material already covered elsewhere in HackTricks.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 972
• MD files fixed: 1

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post:

Content Categories: Based on the analysis, this content was categorized under "Research".

Repository Maintenance:

• MD Files Formatting: 972 files processed (1 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0