Ben Sadeghipour - Owning The Clout Through Server Side Request Forgery
Demonstrates how SSRF vulnerabilities provide a direct path from web application to cloud metadata service, IAM credentials, and full account compromise.
Summary
SSRF to Cloud Account Takeover
Ben Sadeghipour (NahamSec, prolific bug bounty hunter and security educator) presents a practical methodology for chaining Server-Side Request Forgery (SSRF) vulnerabilities into full cloud account compromise.
SSRF Mechanics and Discovery
The talk covers techniques for identifying SSRF parameters — URL-fetching features, webhook configurations, image proxy endpoints, PDF generation services — and demonstrates bypassing common blacklist-based SSRF filters using IP encoding, DNS rebinding, and IPv6.
Cloud Metadata Service Exploitation
By directing SSRF requests to 169.254.169.254 (AWS EC2 metadata service) or equivalent Azure/GCP endpoints, attackers retrieve IAM role credentials for the compromised application server, obtaining cloud API access keys with the application's assigned permissions.
Privilege Escalation to Account Takeover
With IAM credentials, attackers enumerate accessible resources (S3 buckets, RDS snapshots, Secrets Manager entries), demonstrating how a single SSRF bug in a low-privilege service leads to full cloud account compromise through privilege escalation via IAM policy misconfigurations.
Related talks
Main Stage·37 min
Yakir Kadkoda · Michael Katchinskiy · Ofek Itach
Six critical attack vectors exploiting implicit and internal shadow resources created by AWS services to achieve cross-tenant and account takeover.
Main Stage·40 min
Eduard Agavriloae · Matei Josephs
Analysis of 3.1 million public Amazon Machine Images uncovering exposed credentials, API keys, and account takeover vectors.
Main Stage·39 min
Nick Frichette
Deep dive into vulnerabilities in AWS services and cloud architectures that enable attackers to gain initial access to customer workloads.