Leverage Writable S3 Bucket to Steal Admin Cookie

This beginner lab shows how insecure S3 bucket permissions combined with weak web server security can lead to takeover of a privileged admin account. Starting from a single IP address, you enumerate a web application, discover a world-writable S3 bucket serving its static assets, and tamper with a hosted JavaScript file to steal an administrator's session cookie. You then hijack the admin session to reach an export feature that leaks sensitive IAM and service account credentials.

As part of an engagement against Huge Logistics, you probe a provided IP address to map its services and hunt for weaknesses. When you find a vulnerability, you exploit it to reach and safely access sensitive data, demonstrating real risk to the client.

• Basic Linux command line knowledge
• Familiarity with the AWS CLI
• Basic understanding of HTTP and web cookies

• Perform basic web enumeration and script directory and file discovery in Python
• Enumerate S3 bucket contents and assess bucket and object ACLs with the AWS CLI
• Validate and abuse public write access to an S3 bucket by uploading files
• Inject a JavaScript cookie-stealing payload into a bucket-hosted asset and capture data with a Netcat listener
• Perform a session hijacking attack by replacing a session cookie in the browser
• Extract sensitive IAM and service account credentials from an admin export function
• Understand web server mitigations such as HTTPS, CSP, SameSite, HttpOnly, and subresource integrity, and identify public buckets with Amazon Macie

Session hijacking of privileged users is a serious real-world threat, and research estimates that between 5 and 20 percent of all public S3 buckets are writable. Combining a writable bucket with plaintext HTTP lets an attacker tamper with served assets and steal admin sessions.