Conversation

Notices

1. Embed this notice
   Graham Sutherland -> EMF 📞8087 (gsuberland@chaos.social)'s status on Thursday, 21-May-2026 04:44:34 JST Graham Sutherland -> EMF 📞8087

   fun trick: if someone gives a hosted LLM a skill that lets it fetch web pages (directly, not through some third party scraper service) and it's hosted on AWS, you can often trick it into fetching data from the AWS instance metadata server (IMDS) at 169.254.169.254 / [fd00:ec2::254]. the higher end models tend to refuse if you give the IP, but you can just spin up a domain with A/AAAA records pointing at that IP and request that instead. if IMDSv1 isn't disabled you can get secrets out of it.

   • Embed this notice
     ../kajer/. (kajer@infosec.exchange)'s status on Sunday, 24-May-2026 16:16:41 JST ../kajer/.

     in reply to

     @gsuberland

     fun times with https://www.man7.org/linux/man-pages/man3/inet.3.html

     169.254.169.254 can also be -

     2852039166
     0xA9FEA9FE
     a9.fe.a9.fe
     or
     251.376.251.376

     just incase someone tried to be clever and prohibit queries about 169.254 addresses

   • Embed this notice
     Ryan Castellucci (they/them) :nonbinary_flag: (ryanc@infosec.exchange)'s status on Sunday, 24-May-2026 16:16:57 JST Ryan Castellucci (they/them) :nonbinary_flag:

     in reply to

     • ../kajer/.

     @kajer @gsuberland you can mix and match formats across octets for some fucking reason