AWS - CloudFront Post Exploitation

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

• If you want to see your company advertised in HackTricks or download HackTricks in PDF Check the SUBSCRIPTION PLANS!

• Get the official PEASS & HackTricks swag

• Discover The PEASS Family, our collection of exclusive NFTs

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share your hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

CloudFront

For more information check:

pageAWS - CloudFront Enum

Man-in-the-Middle

This blog post proposes a couple of different scenarios where a Lambda could be added (or modified if it's already being used) into a communication through CloudFront with the purpose of stealing user information (like the session cookie) and modifying the response (injecting a malicious JS script).

scenario 1: MitM where CloudFront is configured to access some HTML of a bucket

• Create the malicious function.

• Associate it with the CloudFront distribution.

• Set the event type to "Viewer Response".

Accessing the response you could steal the users cookie and inject a malicious JS.

scenario 2: MitM where CloudFront is already using a lambda function

• Modify the code of the lambda function to steal sensitive information

You can check the tf code to recreate this scenarios here.

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

• If you want to see your company advertised in HackTricks or download HackTricks in PDF Check the SUBSCRIPTION PLANS!

• Get the official PEASS & HackTricks swag

• Discover The PEASS Family, our collection of exclusive NFTs

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share your hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.