TryHackMe - Complimentary CFT (Hacker Holidays)
The goal of this challenge was to identify how the application obtained AWS access without requiring user authentication and to exploit an IAM misconfiguration in order to retrieve the flag from a DynamoDB table. Solution 1. Analyze the application I first inspected the web page source and found that it loads an app.js file. Reviewing this file revealed several important details: AWS Region: us-east-1 Cognito Identity Pool ID: us-east-1:836c0949-292d-485b-b532-52d5ca7bb688 DynamoDB Table: complimentary-GuestWellnessProfiles The application uses AWS Cognito Identity Pools to automatically provide temporary AWS credentials to every visitor without requiring a login. 2. Obtain temporary AWS credentials In the browser console, I executed: AWS.config.credentials This command displayed the temporary AWS credentials assigned to the guest user, including: AccessKeyId SecretAccessKey SessionToken These credentials were automatically generated through AWS Cognito. 3. Test the IAM perm...