# How I got $400 for my first SSRF bug?

PDF-generation endpoint accepted raw HTML, so an iframe with file:// and 169.254.169.254 URLs leaked /etc/passwd and AWS EC2 credentials into the PDF.

- Payout: $400
- Severity: high
- Program: -
- Credited: Usama Varikkottil
- Disclosed: 2021-05-01
- Write-up quality: 6/10
- Original: https://blog.usamav.dev/how-i-got-400-usd-for-my-first-ssrf-bug
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-usamav-dev-how-i-got-400-usd-for-my-first-ssrf-bug
- Tags: domain:web impact:data-leak impact:internal-access kind:bounty platform:blog sev:high tech:aws technique:source-review vuln:info-disclosure vuln:ssrf

**Target:** PDF generation API endpoint with html parameter
**Root cause:** Server-side HTML-to-PDF renderer fetched arbitrary URLs from user-supplied HTML (iframe src) without validation, allowing file:// and link-local metadata access.
**Steps:**
1. Intercept Print request; note `html` parameter containing HTML rendered to PDF
2. Submit `<iframe src=https://www.usamav.dev width=100% height=100%>` and confirm external fetch in PDF
3. Submit `<iframe src=file:///etc/passwd width=100% height=100%>` to read local files
4. Submit `<iframe src="http://169.254.169.254/latest/meta-data" width="100%" height="100%">` to read EC2 metadata
5. Automate: POST html, capture unique PDF code, GET second endpoint to retrieve PDF
**How found:** After 8+ hours exploring the app, noticed a Print button generating PDFs; intercepted the request and saw a raw `html` parameter, hypothesizing the renderer would fetch embedded iframe sources.
**Exploitation:** Attacker submits crafted HTML to the PDF generator; the headless renderer fetches file:// paths and the EC2 metadata service, embedding secrets (access keys, secret_key, MAC, instance details) into the returned PDF.
**Escalation:** Pivoted from external iframe fetch to local file read, then to AWS IMDS credential theft.
**Insight:** Any HTML-to-PDF/headless-browser feature with a raw HTML parameter is an SSRF/file-read candidate: test iframe src with external, file://, and 169.254.169.254 URLs, and check if output is returned via a second fetch-by-ID endpoint.