AWS - Lambda Unauthenticated Access

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

• If you want to see your company advertised in HackTricks or download HackTricks in PDF Check the SUBSCRIPTION PLANS!

• Get the official PEASS & HackTricks swag

• Discover The PEASS Family, our collection of exclusive NFTs

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share your hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Public Function URL

It's possible to relate a Lambda with a public function URL that anyone can access. It could contain web vulnerabilities.

Public URL template

https://{random_id}.lambda-url.{region}.on.aws/

Get Account ID from public Lambda URL

Just like with S3 buckets, Data Exchange and API gateways, It's possible to find the account ID of an account abusing the aws:ResourceAccount Policy Condition Key from a public lambda URL. This is done by finding the account ID one character at a time abusing wildcards in the aws:ResourceAccount section of the policy. This technique also allows to get values of tags if you know the tag key (there some default interesting ones).

You can find more information in the original research and the tool conditional-love to automate this exploitation.

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

• If you want to see your company advertised in HackTricks or download HackTricks in PDF Check the SUBSCRIPTION PLANS!

• Get the official PEASS & HackTricks swag

• Discover The PEASS Family, our collection of exclusive NFTs

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share your hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.