whx
/
killchain-compendium
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

added details about API Gateway

This commit is contained in:
gurkenhabicht 2024-02-26 15:50:34 +01:00
parent ea4d65e166
commit 128eb30906
1 changed files with 37 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
Enumeration/AWS.md
View File

@ -1468,8 +1468,42 @@ An HTTP API consists of the following parts.
* HTTP Method
* Endpoint the request is queried
There is an option for real-time, bidirectional websocket connection.
It acts as a serverless reverse proxy for other APIs.
There is an option for real-time, bidirectional websocket connection, besides
regular RESTlike HTTP(S) APIs.
Lambda acts as a service proxy. The API Gateway can be attached to other AWS resources, e.g. Lambda. The Lambda authorizer can be used to check for credentials to other resources.
Monitoring is an integrated part of the Gateway.
Data the API Gateway uses is stored in an S3 bucket or a DynamoDB.
Microservices can be used through the API Gateway as well.
#### Lambda Authorizer
Lambda acts as a service proxy for the API Gateway. The API Gateway can be
attached to other AWS resources, e.g. Lambda. The Lambda authorizer can be used
to check for credentials to other resources. Authorization can be done via
regular IAM or OAuth2. The authorization can be customized for access.
A policy is set for authorization against resources. Watch out for `*` wildcards
inside these Lambda authorizer policies to get unexpected permissions.
#### Use an API Gateway as a Reverse Proxy
Rotation of IP addresses for an attack may bypass restrictions, like rate-limiting, set for an address.
This can be done via VPNs, e.g. Tor or more suitable in this case using the AWS
API Gateway to rotate the IP address via FireProx.
Use the Cloudshell inside a browser to clone and install the [Fireprox repository](https://github.com/ustayready/fireprox). Start `fire.py` afterwards.
You can use Fireprox externally from the AWS, but you have set an endpoint via a URL to achieve a connection.
```sh
./fire.py --command create --url <URL>
```
Using any of these two lets you list existing APIs.
```sh
./fire.py --command list