One of the challenges for lambda function testing is to incorporating and integrating traditional effective tools like netcat, burp proxy or sqlmap. These tools runs on HTTP(S) pipes while lambda function's events can be coming from any where without HTTP pipe. Hence, one can leverage tool like tunnelLambda while performing pentesting. It is part of our scanLambda toolkit (Here - http://blog.blueinfy.com/p/blog-page.html).
It is very simple as shown below. It establishes tunnel between your target lambda function and your specific tool on localhost/port.
'tunnelLambda' helps in establishing a tunnel from your shell to a targeted lambda function. It helps in sending HTTP traffic to the selected port, which will automatically tunnel to the test function. Hence, now we can use some standard HTTP tools like netcat, sqlmap, Burp or ZAP to test the lambda function.
Once it is set, the script will listen on the target port for both GET and POST requests as shown below: -
When you make a GET request it will serve a simple HTML page which can be used to interact with the lambda function as shown in the below figure. We can just open the page in a browser, put the event stream and click on "Send" button. It will show the output once it is invoked.
Also, now we can use tools like netcat, burp, sqlmap or any other tool to make a POST request directly. Here is our HTTP request,
$ cat sqltest.txt
POST / HTTP/1.1
Host: localhost:8888
Content-Length: 17
{"name":"john"}
We can push it to netcat,
$ cat sqltest.txt | nc localhost 8888
HTTP/1.0 200 OK
Server: BaseHTTP/0.6 Python/3.6.4
Date: Fri, 07 Sep 2018 03:04:41 GMT
Content-type: application/json
{"id": "1239873"}
We can start running sqlmap as well.
$ python sqlmap.py -r ../sqltest.txt
___
__H__
___ ___[.]_____ ___ ___ {1.2.9.6#dev}
|_ -| . [)] | .'| . |
|___|_ [']_|_|_|__,| _|
|_|V |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 08:37:00
[08:37:00] [INFO] parsing HTTP request from '../sqltest.txt'
JSON data found in POST data. Do you want to process it? [Y/n/q] Y
[08:37:05] [INFO] testing connection to the target URL
[08:37:07] [INFO] testing if the target URL content is stable
[08:37:09] [INFO] target URL content is stable
[08:37:09] [INFO] testing if (custom) POST parameter 'JSON name' is dynamic
…
…
…
We need to configure the details in Burp repeater as shown below:
Once it is set, we can make the call as shown below:
Next, we can simply send the request to intruder and run attacks as shown below:
Hence, this allows us to quickly leverage all popular tools against lambda functions.
Article by Hemil Shah
It is very simple as shown below. It establishes tunnel between your target lambda function and your specific tool on localhost/port.
'tunnelLambda' helps in establishing a tunnel from your shell to a targeted lambda function. It helps in sending HTTP traffic to the selected port, which will automatically tunnel to the test function. Hence, now we can use some standard HTTP tools like netcat, sqlmap, Burp or ZAP to test the lambda function.
Once it is set, the script will listen on the target port for both GET and POST requests as shown below: -
When you make a GET request it will serve a simple HTML page which can be used to interact with the lambda function as shown in the below figure. We can just open the page in a browser, put the event stream and click on "Send" button. It will show the output once it is invoked.
Also, now we can use tools like netcat, burp, sqlmap or any other tool to make a POST request directly. Here is our HTTP request,
$ cat sqltest.txt
POST / HTTP/1.1
Host: localhost:8888
Content-Length: 17
{"name":"john"}
We can push it to netcat,
$ cat sqltest.txt | nc localhost 8888
HTTP/1.0 200 OK
Server: BaseHTTP/0.6 Python/3.6.4
Date: Fri, 07 Sep 2018 03:04:41 GMT
Content-type: application/json
{"id": "1239873"}
We can start running sqlmap as well.
$ python sqlmap.py -r ../sqltest.txt
___
__H__
___ ___[.]_____ ___ ___ {1.2.9.6#dev}
|_ -| . [)] | .'| . |
|___|_ [']_|_|_|__,| _|
|_|V |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 08:37:00
[08:37:00] [INFO] parsing HTTP request from '../sqltest.txt'
JSON data found in POST data. Do you want to process it? [Y/n/q] Y
[08:37:05] [INFO] testing connection to the target URL
[08:37:07] [INFO] testing if the target URL content is stable
[08:37:09] [INFO] target URL content is stable
[08:37:09] [INFO] testing if (custom) POST parameter 'JSON name' is dynamic
…
…
…
We need to configure the details in Burp repeater as shown below:
Once it is set, we can make the call as shown below:
Next, we can simply send the request to intruder and run attacks as shown below:
Hence, this allows us to quickly leverage all popular tools against lambda functions.
Article by Hemil Shah