AWS - RDS Unauthenticated Enum

Leer AWS hak vanaf nul tot held met htARTE (HackTricks AWS Red Team Expert)!

Ander maniere om HackTricks te ondersteun:

RDS

Vir meer inligting, kyk:

AWS - Relational Database (RDS) Enum

Openbare Poort

Dit is moontlik om openbare toegang tot die databasis vanaf die internet te gee. Die aanvaller sal steeds die gebruikersnaam en wagwoord, IAM-toegang, of 'n exploit moet ken om in die databasis in te gaan.

Openbare RDS-skyfies

AWS maak dit moontlik om enigeen toegang te gee om RDS-skyfies af te laai. Jy kan hierdie openbare RDS-skyfies baie maklik lys vanaf jou eie rekening:

# Public RDS snapshots
aws rds describe-db-snapshots --include-public

## Search by account ID
aws rds describe-db-snapshots --include-public --query 'DBSnapshots[?contains(DBSnapshotIdentifier, `284546856933:`) == `true`]'
## To share a RDS snapshot with everybody the RDS DB cannot be encrypted (so the snapshot won't be encryted)
## To share a RDS encrypted snapshot you need to share the KMS key also with the account


# From the own account you can check if there is any public snapshot with:
aws rds describe-db-snapshots --snapshot-type public [--region us-west-2]
## Even if in the console appear as there are public snapshot it might be public
## snapshots from other accounts used by the current account

Openbare URL-sjabloon

mysql://{user_provided}.{random_id}.{region}.rds.amazonaws.com:3306
postgres://{user_provided}.{random_id}.{region}.rds.amazonaws.com:5432
Leer AWS-hacking vanaf nul tot held met htARTE (HackTricks AWS Red Team Expert)!

Ander maniere om HackTricks te ondersteun:

Last updated