https://blog.ssrf.in/post/example-of-attack-on-gce-and-gke-instance-using-ssrf-vulnerability/

cloud-service-metadata-api-list.md

AWS

Link : http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#instancedata-data-categories

• http://169.254.169.254/latest/user-data
• http://169.254.169.254/latest/user-data/iam/security-credentials/${ROLE NAME}
• http://169.254.169.254/latest/meta-data/iam/security-credentials/${ROLE NAME}
• http://169.254.169.254/latest/meta-data/
• http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key
• http://169.254.169.254/latest/meta-data/public-keys/${ID}/openssh-key

GCP

Link : https://cloud.google.com/compute/docs/storing-retrieving-metadata

ヘッダーに Metadata-Flavor: Google か X-Google-Metadata-Request: True が必要

• http://metadata.google.internal/computeMetadata/v1/
• http://metadata.google.internal/computeMetadata/v1/instance/
• http://metadata.google.internal/computeMetadata/v1/project/

v1beta1 は ヘッダーはいらない

• http://metadata.google.internal/computeMetadata/v1beta1/
• http://metadata.google.internal/computeMetadata/v1beta1/project/attributes/ssh-keys
• http://metadata.google.internal/computeMetadata/v1beta1/instance/service-accounts/default/token
• http://metadata.google.internal/computeMetadata/v1beta1/instance/attributes/kube-env

Azure

Link : https://docs.microsoft.com/ja-jp/azure/virtual-machines/windows/instance-metadata-service

ヘッダーに Metadata:true が必要

• http://169.254.169.254/metadata/

OpenStack

Link : https://docs.openstack.org/nova/latest/user/metadata-service.html

• http://169.254.169.254/openstack

Digital Ocean

Link : https://developers.digitalocean.com/documentation/metadata/

• http://169.254.169.254/metadata/v1/

Alibaba

Link : https://www.alibabacloud.com/help/faq-detail/49122.htm

• http://100.100.100.200/latest/meta-data/
• http://100.100.100.200/latest/meta-data/ram/security-credentials/${role-name}

Container

LXD

• https://<container gateway ip>:8443/v1
  • クレデンシャル or 鍵が必要
  • ルーティングが設定されている必要あり