Webhook-url-http-3a-2f-2f169.254.169.254-2fmetadata-2fidentity-2foauth2-2ftoken |work| [ 1080p 2025 ]

Azure IMDS requires a specific header: Metadata: true . Most SSRF attacks fail if your server doesn't automatically include this.

An attacker finds a feature that asks for a URL (like a webhook or image uploader). Payload: They enter the Azure Metadata URL. Execution: Your server fetches the URL internally. Azure IMDS requires a specific header: Metadata: true

The IP address 169.254.169.254 is a non-routable link-local address used by major cloud providers like , AWS , and GCP to host their Instance Metadata Service (IMDS) . Azure IMDS requires a specific header: Metadata: true