# AWS - Cognito Unauthenticated Enum

{{#include ../../../../banners/hacktricks-training.md}}

## Unauthenticated Cognito

Cognito is an AWS service that enable developers to **grant their app users access to AWS services**. Ontwikkelaars sal **IAM roles to authenticated users** in hul app toeken (mense kan moontlik net sign up) en hulle kan ook 'n **IAM role to unauthenticated users** toeken.

For basic info about Cognito check:

{{#ref}}
../../aws-services/aws-cognito-enum/
{{#endref}}

### Identity Pool ID

Identity Pools kan **IAM roles to unauthenticated users** toeken wat net die **Identity Pool ID** ken (wat redelik algemeen is om te **find**), en 'n aanvaller met hierdie inligting kan probeer om toegang tot daardie IAM role te kry en dit uit te buit.  
Verder kan IAM roles ook aan **authenticated users** toegeken word wat die Identity Pool gebruik. As 'n aanvaller 'n gebruiker kan **register a user** of reeds **access to the identity provider** het wat in die identity pool gebruik word, kan hy toegang kry tot die **IAM role being given to authenticated** users en die voorregte misbruik.

[**Check how to do that here**](../../aws-services/aws-cognito-enum/cognito-identity-pools.md).

### User Pool ID

Standaard laat Cognito toe dat nuwe gebruikers registreer. Om 'n gebruiker te kan registreer kan jou toegang gee tot die onderliggende toepassing of tot die **authenticated IAM access role of an Identity Pool** wat die Cognito User Pool as identity provider aanvaar. [**Check how to do that here**](../../aws-services/aws-cognito-enum/cognito-user-pools.md#registration).

### Pacu modules for pentesting and enumeration

[Pacu](https://github.com/RhinoSecurityLabs/pacu), die AWS exploitation framework, sluit nou die "cognito__enum" en "cognito__attack" modules in wat die enumeration van alle Cognito-bronne in 'n rekening outomatiseer en swak konfigurasies, gebruikersattribuutte wat vir toegangbeheer gebruik word, ens. merk, en ook user creation (insluitend MFA support) en privilege escalation gebaseer op modifiable custom attributes, usable identity pool credentials, assumable roles in id tokens, ens. outomatiseer.

For a description of the modules' functions see part 2 of the [blog post](https://rhinosecuritylabs.com/aws/attacking-aws-cognito-with-pacu-p2). For installation instructions see the main [Pacu](https://github.com/RhinoSecurityLabs/pacu) page.

#### Usage

Sample `cognito__attack` usage to attempt user creation and all privesc vectors against a given identity pool and user pool client:
```bash
Pacu (new:test) > run cognito__attack --username randomuser --email XX+sdfs2@gmail.com --identity_pools
us-east-2:a06XXXXX-c9XX-4aXX-9a33-9ceXXXXXXXXX --user_pool_clients
59f6tuhfXXXXXXXXXXXXXXXXXX@us-east-2_0aXXXXXXX
```
Voorbeeld van cognito\_\_enum gebruik om alle user pools, user pool clients, identity pools, gebruikers, ens. sigbaar in die huidige AWS account te versamel:
```bash
Pacu (new:test) > run cognito__enum
```
{{#include ../../../../banners/hacktricks-training.md}}
