4 ms·
Hrm. Does it really fetch "local" resources? Visual Mind summary report for http://169.254.169.254/latest/meta-data http://169.254.169.254/latest/meta-data 3
by stevekemp 6y ago
Hrm. Does it really fetch "local" resources?
Visual Mind summary report for http://169.254.169.254/latest/meta-data http://169.254.169.254/latest/meta-data
38% of users are expected to like your site
Yup. That's a security hole:
http://13.232.106.1/thumbs/visualmind/aHR0cDovLzE2OS4yNTQuMTY5LjI1NC9sYXRlc3QvbWV0YS1kYXRh.png http://13.232.106.1/thumbs/visualmind/aHR0cDovLzE2OS4yNTQuMT...
- myraahio 6y agoThanks for pointing out. Shame on us. :)
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]
- pudsec 6y agoBe careful, there's ways around just blocking the IP address; https://myraah.io/index.php/visualmind/report/aHR0cDovL2F3c21ldGFkYXRhLmNvbS9sYXRlc3QvbWV0YS1kYXRh https://myraah.io/index.php/visualmind/report/aHR0cDovL2F3c2...
- stevekemp 6y agoAgreed. I put together a little library to handle denying access to "local" resources, to abstract this a little and avoid overlooking common mistakes: https://github.com/skx/remotehttp https://github.com/skx/remotehttp
- jcims 6y agoGood ol' metadata strikes again. I wish AWS would make a virtual block device for accessing this content instead of network (at least as an option). Much easier to protect at the OS level. The v2 service helps with this but it doesn't beat awareness of the issue.
- eat_veggies 6y agonice http://13.232.106.1/thumbs/visualmind/aHR0cDovLzE2OS4yNTQuMTY5LjI1NC9sYXRlc3QvbWV0YS1kYXRhL2lkZW50aXR5LWNyZWRlbnRpYWxzL2VjMi9zZWN1cml0eS1jcmVkZW50aWFscy9lYzItaW5zdGFuY2U=.png http://13.232.106.1/thumbs/visualmind/aHR0cDovLzE2OS4yNTQuMT...
- vagab0nd 6y agoThat's interesting. How did you go from metadata to token?
- eat_veggies 6y agothe token is in the metadata haha. try creating a report for http://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance http://169.254.169.254/latest/meta-data/identity-credentials...