YoVDO

Hunting for Amazon Cognito Security Misconfigurations

Offered By: NahamSec via YouTube

Tags

Amazon Cognito Courses Bug Bounty Courses Cloud Security Courses Privilege Escalation Courses Offensive Security Courses AWS Security Courses Authentication Bypass Courses

Course Description

Overview

Explore the intricacies of Amazon Cognito security misconfigurations in this 25-minute conference talk from #NahamCon2022EU. Delve into the world of offensive security as Yassine Aboukir, a seasoned bug bounty hunter and security consultant, guides you through identifying applications using Amazon Cognito, uncovering unauthorized access to AWS services, and exploiting authentication bypasses. Learn about privilege escalation techniques through writable user attributes and the risks associated with updating email attributes before verification. Gain valuable insights into common security pitfalls and receive practical recommendations for developers to enhance their Amazon Cognito implementations.

Syllabus

Intro
Introduction to AWS Cognito
How to tell if an application is using Amazon Cognito?
Unauthorized access to AWS services due to Liberal AWS Credentials
Authentication bypass due to enabled Signup API action
Privilege escalation through writable user attributes
Security misconfiguration #4: Updating email attribute before verification
Recommendations for developers


Taught by

NahamSec

Related Courses

Basics of Network Security
Coventry University via FutureLearn
Offensive Security Engineering
Udemy
Hands-on Penetration Testing Labs 4.0
Udemy
Hack Like a Pro - Ethical Hacking from A to Z
Udemy
Exfiltration with Dnscat2
Pluralsight