From 128eb309068143f23dd74ff4c2035567217e785f Mon Sep 17 00:00:00 2001 From: gurkenhabicht Date: Mon, 26 Feb 2024 15:50:34 +0100 Subject: [PATCH] added details about API Gateway --- Enumeration/AWS.md | 40 +++++++++++++++++++++++++++++++++++++--- 1 file changed, 37 insertions(+), 3 deletions(-) diff --git a/Enumeration/AWS.md b/Enumeration/AWS.md index f3d468b..2c1adc8 100644 --- a/Enumeration/AWS.md +++ b/Enumeration/AWS.md @@ -1467,9 +1467,43 @@ An HTTP API consists of the following parts. * Specific HTTP headers * HTTP Method * Endpoint the request is queried - -There is an option for real-time, bidirectional websocket connection. -Lambda acts as a service proxy. The API Gateway can be attached to other AWS resources, e.g. Lambda. The Lambda authorizer can be used to check for credentials to other resources. +It acts as a serverless reverse proxy for other APIs. +There is an option for real-time, bidirectional websocket connection, besides +regular RESTlike HTTP(S) APIs. +Monitoring is an integrated part of the Gateway. + +Data the API Gateway uses is stored in an S3 bucket or a DynamoDB. + +Microservices can be used through the API Gateway as well. + +#### Lambda Authorizer + +Lambda acts as a service proxy for the API Gateway. The API Gateway can be +attached to other AWS resources, e.g. Lambda. The Lambda authorizer can be used +to check for credentials to other resources. Authorization can be done via +regular IAM or OAuth2. The authorization can be customized for access. + +A policy is set for authorization against resources. Watch out for `*` wildcards +inside these Lambda authorizer policies to get unexpected permissions. + +#### Use an API Gateway as a Reverse Proxy + +Rotation of IP addresses for an attack may bypass restrictions, like rate-limiting, set for an address. +This can be done via VPNs, e.g. Tor or more suitable in this case using the AWS +API Gateway to rotate the IP address via FireProx. + +Use the Cloudshell inside a browser to clone and install the [Fireprox repository](https://github.com/ustayready/fireprox). Start `fire.py` afterwards. + +You can use Fireprox externally from the AWS, but you have set an endpoint via a URL to achieve a connection. + +```sh +./fire.py --command create --url +``` + +Using any of these two lets you list existing APIs. + +```sh +./fire.py --command list