# AWS - API Gateway Unauthenticated Enum

{{#include ../../../../banners/hacktricks-training.md}}

### API Invoke bypass

Volgens die praatjie [Attack Vectors for APIs Using AWS API Gateway Lambda Authorizers - Alexandre & Leonardo](https://www.youtube.com/watch?v=bsPKk7WDOnE), Lambda Authorizers kan gekonfigureer word **using IAM syntax** om toestemmings te gee om invoke API endpoints. Dit is geneem [**from the docs**](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-control-access-using-iam-policies-to-invoke-api.html):
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Permission",
"Action": ["execute-api:Execution-operation"],
"Resource": [
"arn:aws:execute-api:region:account-id:api-id/stage/METHOD_HTTP_VERB/Resource-path"
]
}
]
}
```
Die probleem met hierdie manier om permissies te gee om endpoints aan te roep is dat die **"\*" "alles" impliseer** en daar is **geen verdere regex-sintaksis ondersteun nie**.

Some examples:

- A rule such as `arn:aws:execute-apis:sa-east-1:accid:api-id/prod/*/dashboard/*` in order to give each user access to `/dashboard/user/{username}` will give them access to other routes such as `/admin/dashboard/createAdmin` for example.

> [!WARNING]
> Note that **"\*" doesn't stop expanding with slashes**, therefore, if you use "\*" in api-id for example, it could also indicate "any stage" or "any method" as long as the final regex is still valid.\
> So `arn:aws:execute-apis:sa-east-1:accid:*/prod/GET/dashboard/*`\
> Can validate a post request to test stage to the path `/prod/GET/dashboard/admin` for example.

Jy moet altyd duidelik wees oor wat jy wil toelaat en dan nagaan of ander scenario's moontlik is met die toegekenede permissies.

For more info, apart of the [**docs**](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-control-access-using-iam-policies-to-invoke-api.html), you can find code to implement authorizers in [**this official aws github**](https://github.com/awslabs/aws-apigateway-lambda-authorizer-blueprints/tree/master/blueprints).

### IAM Policy Injection

In the same [**talk** ](https://www.youtube.com/watch?v=bsPKk7WDOnE)it's exposed the fact that if the code is using **user input** to **generate the IAM policies**, wildcards (and others such as "." or specific strings) can be included in there with the goal of **bypassing restrictions**.

### Publieke URL-sjabloon
```
https://{random_id}.execute-api.{region}.amazonaws.com/{user_provided}
```
### Kry rekening-ID vanaf openbare API Gateway-URL

Net soos met S3 buckets, Data Exchange en Lambda URL gateways, is dit moontlik om die rekening-ID van ’n rekening te vind deur misbruik te maak van die **`aws:ResourceAccount`** **Policy Condition Key** vanaf ’n openbare API Gateway-URL. Dit word gedoen deur die rekening-ID een karakter op ’n slag te vind deur wildcards in die **`aws:ResourceAccount`** afdeling van die beleid te misbruik.\
Hierdie tegniek maak dit ook moontlik om **waardes van tags** te kry as jy die tag key ken (daar is ’n paar standaard interessante).

Jy kan meer inligting vind in die [**oorspronklike navorsing**](https://blog.plerion.com/conditional-love-for-aws-metadata-enumeration/) en die hulpmiddel [**conditional-love**](https://github.com/plerionhq/conditional-love/) om hierdie eksploitasie te outomatiseer.

{{#include ../../../../banners/hacktricks-training.md}}
