NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Cloud Security
Instance Metadata Service (IMDS) Exploitation
Master IMDS exploitation techniques. Learn to extract cloud credentials via SSRF, understand IMDSv1 vs IMDSv2, and implement robust defenses against metadata attacks.
Room tasks
1What Is IMDS and Why Does It Matter
2SSRF-to-IMDS: How Credential Theft Happens
3Exploiting IMDSv1 vs IMDSv2 Differences
4Guided Lab: Stealing IAM Credentials via SSRF to IMDS
Frequently Asked Questions
What is the instance metadata service?
IMDS is an endpoint available to a cloud virtual machine that exposes details about the instance and, for roles, temporary credentials. Applications on the instance can query it locally.
Why is IMDS a target for SSRF?
If an application can be tricked into requesting the metadata address, the attacker can read the instance role credentials from the response and use them elsewhere in the cloud account.
How does IMDSv2 improve security?
IMDSv2 requires a session token obtained with a PUT request, which blocks many simple SSRF attacks. Enforcing it and limiting hop count are key hardening steps, covered in this free room.