Skip to content

Is serverless insecure? #107

@nelsonic

Description

@nelsonic

http://www.lambdashell.com
image
via/discuss: https://news.ycombinator.com/item?id=17790631

Scrolling down the command history we see:

curl https://yypnj3yzaa.execute-api.us-west-1.amazonaws.com/dev/top-commands >> /tmp/foo.txt &

DO NOT attempt to run it on your Localhost!
But you can view the command list in a browser:
RAW:
image

JSON: (courtesy of Firefox Developer Edition's built-in JSON formatter...)
image

In addition to being a great test of AWS Lambda's security,
this quest is a good exercise in seeing popular "discovery" and "hacking" commands.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions