AWS - Lambda Unauthenticated Access

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Public Function URL

Lambda를 public function URL과 연관시켜 누구나 접근할 수 있게 할 수 있습니다. 이는 웹 취약점을 포함할 수 있습니다.

Public URL template

https://{random_id}.lambda-url.{region}.on.aws/

Get Account ID from public Lambda URL

Just like with S3 buckets, Data Exchange and API gateways, It's possible to find the account ID of an account abusing the aws:ResourceAccount Policy Condition Key from a public lambda URL. This is done by finding the account ID one character at a time abusing wildcards in the aws:ResourceAccount section of the policy. 이 기술은 정책의 aws:ResourceAccount 섹션에서 와일드카드를 악용하여 계정 ID를 한 글자씩 찾아내는 방식으로 수행됩니다. 이 기술을 사용하면 태그 키를 알고 있는 경우 태그 값도 얻을 수 있습니다(기본적으로 흥미로운 것들이 있습니다).

자세한 내용은 original research 및 이 익스플로잇을 자동화하는 도구 conditional-love에서 확인할 수 있습니다.

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.