Skip to content

Latest commit

 

History

History
26 lines (20 loc) · 743 Bytes

README.md

File metadata and controls

26 lines (20 loc) · 743 Bytes

AWSCognitoKiller

AWS Cognito Misconiguration Automation Check

Requirements:

  • Install AWS CLI

Currently Supported:

Automated Check Pre-Authen Misconfigurations:

  • Sign Up Via Client Id - Authentication bypass due to enabled Signup API action
  • Generate AWS credentials from Identity ID - Unauthorized access to AWS services due to Liberal AWS Credentials
  • Enumerate IAM from Generated AWS credentials
  • Sign Up Via Client Id + Client Secret When Application Allows SignUp but Need Proper Secret Hash

Post-Authen Misconfigurations:

  • Privilege escalation through writable user attributes

TODO:

  • Updating email attribute before verification

References: