dwyl / learn-aws-lambda

✨ Learn how to use AWS Lambda to easily create infinitely scalable web services
1.05k stars 202 forks source link

Is serverless insecure? #107

Open nelsonic opened 6 years ago

nelsonic commented 6 years ago

http://www.lambdashell.com image via/discuss: https://news.ycombinator.com/item?id=17790631

Scrolling down the command history we see:

curl https://yypnj3yzaa.execute-api.us-west-1.amazonaws.com/dev/top-commands >> /tmp/foo.txt &

DO NOT attempt to run it on your Localhost! But you can view the command list in a browser: RAW: image

JSON: (courtesy of Firefox Developer Edition's built-in JSON formatter...) image

In addition to being a great test of AWS Lambda's security, this quest is a good exercise in seeing popular "discovery" and "hacking" commands.