- The IP address "169.254.169.254" is routed to the hypervisor and retrieves networking, firewall, and related information for virtually all cloud providers. - This is the call you should make first if you find SSRF in a cloud instance. - If this IP address is specifically banned/filtered: - Try various alternate representations of it: - http://169.254.169.254 - decimal - http://0xa9fea9fe - hexadecimal - http://0xA9.0xFE.0xA9.0xFE - dotted - http://025177524776 - octal - http://①⑥⑨.②⑤④.①⑥⑨.②⑤④ - Unicode - Register a domain you own that points to this IP address - public domains can be registered to private IPs