Webhook-url-http-3a-2f-2f169.254.169.254-2fmetadata-2fidentity-2foauth2-2ftoken — Hot!

The IP address is a link-local address used by major cloud providers (like Azure, AWS, and GCP) to host their Instance Metadata Service (IMDS) .

If an attacker enters http://169.254.169 into a poorly secured webhook field, they are attempting an . They are trying to trick the cloud server into making a request to its own internal metadata service. The Attack Scenario: The IP address is a link-local address used

: Specifies that the request is looking for identity-related info. The IP address is a link-local address used