Skip to content

aws-cognito-enum

Directory actions

More options

Directory actions

More options

Latest commit

 

History

History
 
 

aws-cognito-enum

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
README.md
README.md
 
 
cognito-identity-pools.md
cognito-identity-pools.md
 
 
cognito-user-pools.md
cognito-user-pools.md
 
 

README.md

AWS - Cognito Enum

Support HackTricks and get benefits!

Cognito

Cognito provides authentication, authorization, and user management for your web and mobile apps. Your users can sign in directly with a user name and password, or through a third party such as Facebook, Amazon, Google or Apple.

The two main components of Amazon Cognito are user pools and identity pools. User pools are user directories that provide sign-up and sign-in options for your app users. Identity pools enable you to grant your users access to other AWS services.

User pools

To learn what is a Cognito User Pool check:

{% content-ref url="cognito-user-pools.md" %} cognito-user-pools.md {% endcontent-ref %}

Identity pools

The learn what is a Cognito Identity Pool check:

{% content-ref url="cognito-identity-pools.md" %} cognito-identity-pools.md {% endcontent-ref %}

Enumeration

{% code overflow="wrap" %}

# List Identity Pools
aws cognito-identity list-identity-pools --max-results 60
aws cognito-identity describe-identity-pool --identity-pool-id "eu-west-2:38b294756-2578-8246-9074-5367fc9f5367"
aws cognito-identity list-identities --identity-pool-id <ident-pool-id> --max-results 60
aws cognito-identity get-identity-pool-roles --identity-pool-id <ident-pool-id>

# Identities Datasets
## Get dataset of identity id (inside identity pool)
aws cognito-sync list-datasets --identity-pool-id <ident-pool-id> --identity-id <ident-id>
## Get info of the dataset
aws cognito-sync describe-dataset --identity-pool-id <value> --identity-id <value> --dataset-name <value>
## Get dataset records
aws cognito-sync list-records --identity-pool-id <value> --identity-id <value> --dataset-name <value>

# User Pools
## Get pools
aws cognito-idp list-user-pools --max-results 60

## Get users
aws cognito-idp list-users --user-pool-id <user-pool-id>

## Get groups
aws cognito-idp list-groups --user-pool-id <user-pool-id>

## Get users in a group
aws cognito-idp list-users-in-group --user-pool-id <user-pool-id> --group-name <group-name>

## List App IDs of a user pool
aws cognito-idp list-user-pool-clients --user-pool-id <user-pool-id>

## List configured identity providers for a user pool
aws cognito-idp list-identity-providers --user-pool-id <user-poo

## List user import jobs
aws cognito-idp list-user-import-jobs --user-pool-id <user-pool-id> --max-results 60

## Get MFA config of a user pool
aws cognito-idp get-user-pool-mfa-config --user-pool-id <user-pool-id>

## Get risk configuration
aws cognito-idp describe-risk-configuration --user-pool-id <user-pool-id>

{% endcode %}

Identity Pools - Unauthenticated Enumeration

Just knowing the Identity Pool ID you might be able get credentials of the role associated to unauthenticated users (if any). Check how here.

User Pools - Unauthenticated Enumeration

Even if you don't know a valid username inside Cognito, you might be able to enumerate valid usernames, BF the passwords of even register a new user just knowing the App client ID (which is usually found in source code). Check how here.

Privesc

{% content-ref url="../../aws-privilege-escalation/aws-cognito-privesc.md" %} aws-cognito-privesc.md {% endcontent-ref %}

Unauthenticated Access

{% content-ref url="../../aws-unauthenticated-enum-access/aws-cognito-unauthenticated-enum.md" %} aws-cognito-unauthenticated-enum.md {% endcontent-ref %}

Persistence

{% content-ref url="../../../aws-pentesting/aws-persistence/aws-cognito-persistence.md" %} aws-cognito-persistence.md {% endcontent-ref %}

Support HackTricks and get benefits!