metadata-service-attacks

仓库创建 2026年7月26日最近提交 3 天前SkillHot 收录 2 天前

这个 Skill 做什么

检测能否通过 SSRF 等方式访问云主机的元数据服务（169.254.169.254），因为那里可能会泄露临时 IAM 凭证。遇到可以发起外部请求的漏洞或做云安全评估时用，能判断攻击者是否能借此窃取权限。重点会讲 IMDSv2 和网络控制如何把这个“后门”关上。

▸ 展开 SKILL.md 英文原文

Use when assessing whether SSRF or a foothold can reach a cloud instance metadata service to steal credentials — and how IMDSv2 and network controls stop it.

Stars

Forks

仓库内 Skill

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/jihedbfr-art/cyber-skills/main/skills/06-cloud-security/10-metadata-service-attacks/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/jihedbfr-art/cyber-skills/main/skills/06-cloud-security/10-metadata-service-attacks/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

## Purpose

Every cloud VM has a metadata endpoint at `169.254.169.254` that, among other things, hands out the instance's IAM credentials. If an attacker can make a request reach it — usually via SSRF — they get temporary cloud credentials with whatever the instance role allows. This skill covers testing for that reachability and locking the endpoint down.

## When to use it

Whenever you find SSRF (see the web-app SSRF skill) or land a foothold on a cloud instance and want to know what it can reach. Also as a proactive hardening check on your own fleet — is IMDSv2 enforced everywhere?

## Procedure

1. From the instance (or through an SSRF that reaches it), check whether the legacy **IMDSv

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有