AWS Top 10 Vulnerabilities

Credits:Kontra

Recently I came to know about this awesome site https://application.security which teaches security in the frontend itself. It is so amazing and UI is friendly that anyone would be able to understand it in clear and concise manner.

Especially the labs around cloud security is very good and will easily help to gain beginner level knowledge.

First it teaches how to find and exploit the vulnerability and later it teaches how we can fix and the LOC which was causing the issue.

Here are the AWS Top 10 security Labs which they have hosted and a link to get started:

Subdomain Takeover

Subdomain Takeover | Kontra

S3 Bucket Public ‘READ’ Access

S3 Bucket Public 'READ' Access | Kontra

S3 Bucket Authenticated Users ‘WRITE’ Access

S3 Bucket Authenticated Users 'WRITE' Access | Kontra

PS: Check a real vulnerability I found in ANI news .

Hacking To Deface Into Indian News Media Outlet- ANI News Agency

S3 Directory Traversal

S3 Directory Traversal | Kontra

Weak S3 POST Upload Policy

Insecure S3 POST Upload Policy | Kontra

Lambda Command Injection

Lambda Command Injection | Kontra

Misconfigured Reverse Proxy

Misconfigured Reverse Proxy | Kontra

Misconfigured AWS Cognito Attributes

Misconfigured AWS Cognito Attributes | Kontra

Misconfigured AWS Cognito profile allows self-registration

Misconfigured AWS Cognito Profile Allows Self-Registration | Kontra

Excessive Logging

Leftover Debug Code | Kontra

Dangerous Dependencies

Dangerous Dependencies | Kontra

Lambda XXE Injection

Lambda XML Entity Injection | Kontra