{% hint style="success" %}
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Support HackTricks
- Check the subscription plans!
- Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
- Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.
It's possible to relate a Lambda with a public function URL that anyone can access. It could contain web vulnerabilities.
https://{random_id}.lambda-url.{region}.on.aws/
Just like with S3 buckets, Data Exchange and API gateways, It's possible to find the account ID of an account abusing the aws:ResourceAccount
Policy Condition Key from a public lambda URL. This is done by finding the account ID one character at a time abusing wildcards in the aws:ResourceAccount
section of the policy.
This technique also allows to get values of tags if you know the tag key (there some default interesting ones).
You can find more information in the original research and the tool conditional-love to automate this exploitation.
{% hint style="success" %}
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Support HackTricks
- Check the subscription plans!
- Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
- Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.