--- title: "AWS Cloud Security Challenge: SSRF, IMDSv2, and Cloud Takeover" url: https://daily.dev/posts/aws-cloud-security-challenge-ssrf-imdsv2-and-cloud-takeover-eat7eojpd source_url: https://infosecwriteups.com/aws-cloud-security-challenge-ssrf-imdsv2-and-cloud-takeover-4cc6374ef67f type: article source: "InfoSec Write-ups" published: 2026-08-14T17:31:08.422Z updated: 2026-08-14T17:31:36.771Z tags: ["security", "aws"] reading_time: 7 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # AWS Cloud Security Challenge: SSRF, IMDSv2, and Cloud Takeover **[InfoSec Write-ups](https://daily.dev/sources/infosecwriteups)** · 7 min read · 0 upvotes · 0 comments ## Summary A walkthrough of a Fampay CTF cloud security challenge chaining an SSRF vulnerability in a webhook endpoint with AWS IMDSv2 to steal temporary IAM credentials from an EC2 instance. Since the S3 bucket restricted access to VPC-originating requests, the writeup shows how to bypass this by generating a presigned S3 URL with the stolen credentials and fetching it through the same SSRF endpoint, ultimately retrieving the CTF flag stored in the bucket. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I steal AWS credentials via SSRF when the server uses IMDSv2 instead of IMDSv1? With IMDSv2, a simple GET request to the metadata endpoint is not enough because AWS requires a session token first. Send a PUT request through the SSRF endpoint to http://169.254.169.254/latest/api/token with header X-aws-ec2-metadata-token-ttl-seconds set to a value like 21600, then use the returned token as the X-aws-ec2-metadata-token header on a GET request to /latest/meta-data/iam/security-credentials/ to retrieve the access key, secret key, and session token. _daily.dev surfaces writeups like this for teams hardening SSRF defenses and IMDS configurations._ ### If stolen AWS credentials work but S3 access still returns Access Denied, how can I bypass a VPC-restricted bucket policy? When an S3 bucket policy restricts access to requests originating from inside the VPC, credentials used directly from an external AWS CLI will fail with AccessDenied even if they are valid. The workaround is to generate a presigned S3 URL using the stolen credentials, then fetch that presigned URL through the internal SSRF endpoint so the request originates from inside the VPC and satisfies the bucket's network condition. _security engineers researching VPC-scoped bucket policies can find similar exploitation chains through daily.dev._ ### What is the difference between IMDSv1 and IMDSv2 for AWS EC2 instance metadata security? IMDSv1 allows any simple GET request to 169.254.169.254 to return AWS credentials directly, meaning basic SSRF vulnerabilities that only control the URL can steal credentials. IMDSv2 requires first requesting a session token via a PUT request, then supplying that token as a custom header, X-aws-ec2-metadata-token, on the metadata GET request, which defeats naive SSRF endpoints that cannot control HTTP method or headers. _developers securing EC2 workloads track IMDS hardening details like these on daily.dev._ ## Similar posts on daily.dev - [I Found a Critical SSRF Vulnerability That Could Have Exposed an Entire Server Here’s How](https://daily.dev/posts/i-found-a-critical-ssrf-vulnerability-that-could-have-exposed-an-entire-server-here-s-how-xgeshq0eo) · InfoSec Write-ups · 0 upvotes · 0 comments - [The HTTP 303 SSRF Hack : From Python HTTP Client Defaults to AWS Credential Exfiltration. A Deep Dive Into Escalating a Blind SSRF to Full Read](https://daily.dev/posts/the-http-303-ssrf-hack-from-python-http-client-defaults-to-aws-credential-exfiltration-a-deep-div-m0w7evcrl) · InfoSec Write-ups · 0 upvotes · 1 comments - [Hackers Exploit Pandoc CVE-2025-51591 to Target AWS IMDS and Steal EC2 IAM Credentials](https://daily.dev/posts/hackers-exploit-pandoc-cve-2025-51591-to-target-aws-imds-and-steal-ec2-iam-credentials-hmus02hqb) · The Hacker News · 4 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#aws](https://daily.dev/tags/aws) [View this post on daily.dev](https://daily.dev/posts/aws-cloud-security-challenge-ssrf-imdsv2-and-cloud-takeover-eat7eojpd)