COMING SOONIntermediatePRO
One Packet From Disaster: SSRF to IMDS to S3
A misconfigured WAF in front of a bank's card-application portal was tricked into asking the cloud for its own keys. Follow the request from the web tier into the metadata service, watch an over-privileged role's credentials walk out the door, and reconstruct the 30 GB customer-data theft across CloudTrail, the perimeter, and the WAF logs.
55m
5 tasks
50 points
ProLaunches in 5 days
Oct 20, 2026
View Pro plansTuesday, October 20, 2026 at 9:00 AM
Pro unlocks this operation at launch.
Training Tools
CloudFirewallSIEMQuery
What you'll investigate
5 objectives unlock when this operation goes live.
1Find where the customer data walked out
2Trace the request that started it
3Pin the external operator
4Name the over-trusted identity
5Classify the credential source
Be first when it launches
Create your account and grab Pro before launch. The moment this operation goes live on Oct 20, 2026, you can jump straight in.
Get Started Free