What Attack Targets Cloud Metadata via 169.254.169.254?

After compromising a system, a penetration tester wants more information in order to decide what actions to take next. The tester runs the following commands: curl http://169.254.169.254/latest Which of the following attacks is the penetration tester more likely trying to perform?

  1. Metadata service attack Source Reference Answer
  2. Container escape techniques
  3. Credential harvesting
  4. Resource exhaustion

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests recognition of cloud infrastructure IPs and their role in post-compromise reconnaissance, with candidates often mistakenly selecting credential harvesting instead of identifying the specific metadata service vector.

Accessing the cloud instance metadata service at 169.254.169.254 is a standard post-exploitation technique to gather sensitive configuration and credential data. Community consensus confirms this targets the metadata service rather than container escapes or resource exhaustion.

Option C (Credential harvesting) is frequently chosen because metadata services often contain temporary credentials, but the command specifically targets the metadata endpoint itself, making "Metadata service attack" the precise technical classification.

Community Discussion (4 comments)

Etc_Shadow28000 👍 1 Selected: A
A. Metadata service attack: By accessing the metadata service, the tester can retrieve sensitive information about the instance, including IAM roles and credentials, network configurations, and other details that can be exploited further. • B. Container escape techniques: This is related to breaking out of a container to access the host system. The command provided does not specifically indicate an attempt to escape a container environment. • C. Credential harvesting: While credential harvesting might be a goal, the immediate action of accessing the metadata service suggests the focus is on gathering instance metadata, which may include credentials as part of the retrieved data. • D. Resource exhaustion: This involves depleting system resources to cause a denial of service. The command does not suggest any actions related to resource consumption
041ba31 👍 1 Selected: A
The given command (curl http://169.254.169.254/latest) is specifically designed to access the metadata service of cloud instances (commonly found in AWS EC2 environments). This service contains sensitive details like configuration data and potentially credentials, which can be exploited for further attacks or access escalation
opem 👍 1 Selected: A
You can also detect when an attacker is directly querying the metadata service from the instance by identifying commands such as curl 169.254.169.254 https://securitylabs.datadoghq.com/cloud-security-atlas/attacks/stealing-ec2-instance-role-credentials/
Sleezyglizzy 👍 2 Selected: A
Correct answer

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

The IP address 169.254.169.254 is reserved by cloud providers (primarily AWS EC2) for the Instance Metadata Service (IMDS). Running curl http://169.254.169.254/latest is a direct attempt to query this endpoint to retrieve instance-specific data such as IAM role names, network configurations, and potentially temporary security credentials. Successfully exploiting this allows an attacker to escalate privileges or pivot deeper into the cloud environment, classifying it precisely as a metadata service attack.

Why the Other Options Are Wrong

Container escape techniques involve breaking out of isolated container runtimes to access the host OS, which requires kernel exploits or misconfigurations unrelated to HTTP requests against a link-local IP. Credential harvesting is a broader outcome that may result from querying metadata, but it describes the goal rather than the specific attack vector being executed. Resource exhaustion attacks target availability through flooding or looping, which does not align with a targeted informational retrieval command.

Community Comment Notes

Multiple contributors correctly identify 169.254.169.254 as the standard cloud metadata endpoint used during post-exploitation phase two [1][2]. Commenters emphasize that retrieving IAM roles and network details from this service directly enables further lateral movement and privilege escalation [2]. One user provides a valuable detection reference pointing to Datadog’s security atlas for monitoring unauthorized IMDS queries [3], reinforcing best practices for defensive monitoring alongside offensive understanding.

Official Reference

Exam Strategy

Memorize link-local metadata IPs across major cloud providers (AWS, Azure, GCP all use 169.254.169.254) to instantly recognize cloud reconnaissance commands. When answering post-exploitation questions, always distinguish between the immediate action (querying metadata) and its downstream effect (credential theft) to select the most technically precise option.

Related Analysis

A penetration tester conducted a discovery scan that generat

S-Grade

A security analyst is conducting a penetration test for an o

S-Grade

In Java C/C++, variable initialization is critical because:

A-Grade

← Back to PT0-002 Study Guide