AWS - CloudFront Post Exploitation
Last updated
Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
For more information check:
AWS - CloudFront EnumThis blog post proposes a couple of different scenarios where a Lambda could be added (or modified if it's already being used) into a communication through CloudFront with the purpose of stealing user information (like the session cookie) and modifying the response (injecting a malicious JS script).
Create the malicious function.
Associate it with the CloudFront distribution.
Set the event type to "Viewer Response".
Accessing the response you could steal the users cookie and inject a malicious JS.
Modify the code of the lambda function to steal sensitive information
You can check the tf code to recreate this scenarios here.
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
