> For the complete documentation index, see [llms.txt](https://blog.s1rn3tz.ovh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.s1rn3tz.ovh/pentest-web/ssrf/cloud-ssrf.md).

# Cloud SSRF

## Cloud metadata

### Ressource

{% embed url="<https://book.hacktricks.xyz/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf>" %}

### AWS EC2

`http://169.254.169.254`

ressource: <https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-data-categories.html>

### GCP

* <http://169.254.169.254>
* <http://metadata.google.internal>
* <http://metadata>

### DigitalOcean

`http://169.254.169.254`

### Oracle Cloud

`http://192.0.0.192`

### Alibaba

`http://100.100.100.200`

### VPC AWS

Pour trouver sur quel range d'IP privé le VPC se trouve, il est possible d'utiliser le resolver DNS port 53 se trouvant sur une IP fixe.

Exemples:

* Si le VPC est sur le range 10.0.0.0/8, tenter de contacter l'IP 10.0.0.2:53
* Si le VPC est sur le range 172.16.0.0/12, tenter de contacter l'IP 172.16.0.2:53