Finding multiple SSRF with AWS metadata access on A BANK system
Hi, everyone
My name is Santosh Kumar Sha, I’m a security researcher from India(Assam). In this article, I will be describing How I was able Find multiple SSRF with aws metadata access ON a BANK System and Get access to there production server.
I am now offering 1:1 sessions to share my knowledge and expertise:
SPECIAL COVID-19 Note:
Don’t go outside without any reason . Stay home be safe and also safe other. Special request to my fellow bug-bounty hunter Take care of your health and get vaccinated.
TOOLS used for the exploitation
1. Subfinder (https://github.com/projectdiscovery/subfinder)
2. httpx (https://github.com/projectdiscovery/httpx)
3. gau(Corben) — https://github.com/lc/gau
4. waybackurls(tomnomnom) — https://github.com/tomnomnom/waybackurls.
Story Behind the bug:
This is the write of my compromising the bank production and get access to 100GB customer High profile data by SSRF and escalating it get their aws production server customer stored data.
There was no Responsive disclosure program or Bugbounty program but still i report 15 SSRF aws metadata access bug and Many other critical bug because of them the customer would have…
