Serverless Services Exploitation

---

---

Dive deeper into compromised Lambda functions or API Gateway integrations to exfiltrate code/config or execute payloads.

1. Enumerate Lambda Functions (see section 3.5).
2. Download & Inspect Deployment Package (ZIP and env variables inside).
3. Identify Hardcoded Secrets or Misconfigurations (e.g., environment variables exposing DB credentials).
4. Check Lambda Function Policy for “InvokeFunction” Permissions

   aws lambda get-policy --function-name <function-name>
   

5. If an API Gateway or SQS/SNS resource has permission to invoke, you can craft requests to trigger the function with malicious payloads.
6. For API Gateway: build the base URL from the ARN returned by get-policy and send HTTP requests to test for command injection or exposed functions.