AWS - SNS Post Exploitation
Reading time: 3 minutes
tip
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Support HackTricks
- Check the subscription plans!
- Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
- Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.
SNS
Reading time: 3 minutes
For more information:
Disrupt Messages
Reading time: 3 minutes
In several cases, SNS topics are used to send messages to platforms that are being monitored (emails, slack messages...). If an attacker prevents sending the messages that alert about it presence in the cloud, he could remain undetected.
sns:DeleteTopic
Reading time: 3 minutes
An attacker could delete an entire SNS topic, causing message loss and impacting applications relying on the topic.
aws sns delete-topic --topic-arn <value>
Potential Impact: Message loss and service disruption for applications using the deleted topic.
sns:Publish
Reading time: 3 minutes
An attacker could send malicious or unwanted messages to the SNS topic, potentially causing data corruption, triggering unintended actions, or exhausting resources.
aws sns publish --topic-arn <value> --message <value>
Potential Impact: Data corruption, unintended actions, or resource exhaustion.
sns:SetTopicAttributes
Reading time: 3 minutes
An attacker could modify the attributes of an SNS topic, potentially affecting its performance, security, or availability.
aws sns set-topic-attributes --topic-arn <value> --attribute-name <value> --attribute-value <value>
Potential Impact: Misconfigurations leading to degraded performance, security issues, or reduced availability.
sns:Subscribe
, sns:Unsubscribe
Reading time: 3 minutes
An attacker could subscribe or unsubscribe to an SNS topic, potentially gaining unauthorized access to messages or disrupting the normal functioning of applications relying on the topic.
aws sns subscribe --topic-arn <value> --protocol <value> --endpoint <value>
aws sns unsubscribe --subscription-arn <value>
Potential Impact: Unauthorized access to messages, service disruption for applications relying on the affected topic.
sns:AddPermission
, sns:RemovePermission
Reading time: 3 minutes
An attacker could grant unauthorized users or services access to an SNS topic, or revoke permissions for legitimate users, causing disruptions in the normal functioning of applications that rely on the topic.
aws sns add-permission --topic-arn <value> --label <value> --aws-account-id <value> --action-name <value>
aws sns remove-permission --topic-arn <value> --label <value>
Potential Impact: Unauthorized access to the topic, message exposure, or topic manipulation by unauthorized users or services, disruption of normal functioning for applications relying on the topic.
sns:TagResource
, sns:UntagResource
Reading time: 3 minutes
An attacker could add, modify, or remove tags from SNS resources, disrupting your organization's cost allocation, resource tracking, and access control policies based on tags.
aws sns tag-resource --resource-arn <value> --tags Key=<key>,Value=<value>
aws sns untag-resource --resource-arn <value> --tag-keys <key>
Potential Impact: Disruption of cost allocation, resource tracking, and tag-based access control policies.
tip
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Support HackTricks
- Check the subscription plans!
- Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
- Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.