Prep RoomSign inStart free
Code RoomSSRF to credential theft
HardPrep Room Coding #2523

SSRF to credential theft

On-callSecurityReliability & on-callSenior–Staff~45 min

Your WAF/app logs show a public image-fetch feature ('preview URL') being called with internal/loopback targets: http://169.254.169.254/latest/meta-data/iam/security-credentials/. Shortly after, CloudTrail shows the web tier's instance role making API calls (s3:GetObject across multiple buckets, then sts:GetCallerIdentity) from an external IP that is NOT your infrastructure. The image-preview feature shipped last sprint and fetches any user-supplied URL server-side. How do you triage, contain, and remediate this SSRF-to-credential-theft incident?

What a strong answer looks like

Stop the bleeding first (mitigate), then form hypotheses from real signals. Separate root cause from symptom, communicate status as you go, and close with what prevents a repeat.

0:00 of about 45 min
Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.