SSRF in cloud-hosted (mock AWS) app

/metadata · sink: requests.get

A profile-image fetcher running on a fake EC2. Reach the metadata service.

Hint

This box is pretending to be an EC2 instance. AWS IMDSv1 lives at http://169.254.169.254/latest/meta-data/. Try walking the tree.