Skip to content

Latest commit

 

History

History
68 lines (45 loc) · 3.73 KB

aws-rds-unauthenticated-enum.md

File metadata and controls

68 lines (45 loc) · 3.73 KB

AWS - RDS Unauthenticated Enum

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

RDS

For more information check:

{% content-ref url="../aws-services/aws-databases/aws-relational-database-rds-enum.md" %} aws-relational-database-rds-enum.md {% endcontent-ref %}

Public Port

It's possible to give public access to the database from the internet. The attacker will still need to know the username and password, IAM access, or an exploit to enter in the database.

Public RDS Snapshots

AWS allows giving access to anyone to download RDS snapshots. You can list these public RDS snapshots very easily from your own account:

# Public RDS snapshots
aws rds describe-db-snapshots --include-public

## Search by account ID
aws rds describe-db-snapshots --include-public --query 'DBSnapshots[?contains(DBSnapshotIdentifier, `284546856933:`) == `true`]'
## To share a RDS snapshot with everybody the RDS DB cannot be encrypted (so the snapshot won't be encryted)
## To share a RDS encrypted snapshot you need to share the KMS key also with the account


# From the own account you can check if there is any public snapshot with:
aws rds describe-db-snapshots --snapshot-type public [--region us-west-2]
## Even if in the console appear as there are public snapshot it might be public
## snapshots from other accounts used by the current account

Public URL template

mysql://{user_provided}.{random_id}.{region}.rds.amazonaws.com:3306
postgres://{user_provided}.{random_id}.{region}.rds.amazonaws.com:5432
Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks: