Search
Search the blog.
Exploiting Cloud Metadata via SSRF: 169.254.169.254 on AWS, GCP, and Azure
How SSRF turns into stolen cloud credentials through the 169.254.169.254 metadata endpoint. IMDSv1 vs IMDSv2, the GCP header requirement, Azure quirks, and why IMDSv2 still gets popped.
SSRF Filter Bypass: Beating Allow-Lists, Blocklists, and Parser Mismatches
Why SSRF filters fail in practice. Parser confusion, IP encoding, DNS rebinding, and redirect chains explained from the attacker's side, with the defensive fixes that actually hold.
SSRF Payload Cheat Sheet: Encodings, Bypasses, and What Actually Lands
A working SSRF payload list from real engagements: IP encoding tricks, allow-list bypasses, protocol smuggling, and the cloud metadata endpoints worth memorizing.
Welcome to the blog
How this SEO-first Next.js template is wired together — and what you get on day one.
An SEO checklist for content-driven sites
A practical, prioritized checklist for content sites that want to win organic traffic in 2026.