Unveiling the Vulnerabilities: Hacking Cloud Native Apps and Discovering the Silver Lining

This talk covers how to attack cloud-hosted web applications from a black-box position, where the tester has no cloud account and the cloud pieces of an app are not obvious. The speaker argues that traditional scanners miss these issues, so testers first need to find which cloud services an app relies on. Fingerprinting looks at URL patterns, response headers and bundled JavaScript for signs of storage buckets, Cognito pools and API gateways. A Burp extension built for this purpose, Cloud Asset Watcher, flags such assets while you browse.

The middle section covers the main weak spots. For Cognito, the checks include open sign-up, mutable user attributes, unverified emails and unauthenticated identity pool roles that issue AWS credentials. For OAuth, it covers loose redirect URI checks, missing state validation and response-type switching. One takeover case shows how trusting a mutable email attribute, instead of a stable subject identifier, lets an attacker log in as another user. Public buckets, wildcard IAM policies and role-passing abuse lead to privilege escalation, while API and Lambda examples include leaky older API versions, mass assignment and unsafe code in functions.

The closing advice is to inventory cloud resources, review IAM policies for broad permissions, key identity decisions on immutable identifiers, validate redirect URIs strictly and avoid undocumented APIs. Practitioners should also watch billing and cloud audit logs for signs of misuse.