hacktricks-cloud/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-rds-unauthenticated-enum/README.md

AWS - RDS Unauthenticated Enum

{{#include ../../../../banners/hacktricks-training.md}}

RDS

Per maggiori informazioni consulta:

{{#ref}} ../../aws-services/aws-relational-database-rds-enum.md {{#endref}}

Porta pubblica

È possibile concedere accesso pubblico al database da internet. L'attaccante avrà comunque bisogno di conoscere lo username e la password, IAM access, o un exploit per entrare nel database.

Public RDS Snapshots

AWS permette di concedere l'accesso a chiunque per scaricare RDS snapshots. Puoi elencare questi public RDS snapshots molto facilmente dal tuo account:

# Public RDS snapshots
aws rds describe-db-snapshots --include-public

## Search by account ID
aws rds describe-db-snapshots --include-public --query 'DBSnapshots[?contains(DBSnapshotIdentifier, `284546856933:`) == `true`]'
## To share a RDS snapshot with everybody the RDS DB cannot be encrypted (so the snapshot won't be encryted)
## To share a RDS encrypted snapshot you need to share the KMS key also with the account


# From the own account you can check if there is any public snapshot with:
aws rds describe-db-snapshots --snapshot-type public [--region us-west-2]
## Even if in the console appear as there are public snapshot it might be public
## snapshots from other accounts used by the current account

Snapshot di cluster RDS pubblici

Allo stesso modo, puoi cercare snapshot di cluster RDS

# Public RDS cluster snapshots
aws rds describe-db-cluster-snapshots --include-public

## Search by account ID
aws rds describe-db-cluster-snapshots --include-public --query 'DBClusterSnapshots[?contains(DBClusterSnapshotIdentifier, `284546856933:`) == `true`]'

# From the own account you can check if there is any public cluster snapshot with:
aws rds describe-db-cluster-snapshots --snapshot-type public [--region us-west-2]

Modello URL pubblico

mysql://{user_provided}.{random_id}.{region}.rds.amazonaws.com:3306
postgres://{user_provided}.{random_id}.{region}.rds.amazonaws.com:5432

{{#include ../../../../banners/hacktricks-training.md}}