Hunting for Amazon Cognito Security Misconfigurations

Hunting for Amazon Cognito Security Misconfigurations

Explore the intricacies of Amazon Cognito security misconfigurations in this 25-minute conference talk from #NahamCon2022EU. Delve into the world of offensive security as Yassine Aboukir, a seasoned bug bounty hunter and security consultant, guides you through identifying applications using Amazon Cognito, uncovering unauthorized access to AWS services, and exploiting authentication bypasses. Learn about privilege escalation techniques through writable user attributes and the risks associated with updating email attributes before verification. Gain valuable insights into common security pitfalls and receive practical recommendations for developers to enhance their Amazon Cognito implementations.