pacu
pacu copied to clipboard
cfn__resource_injection: Wrongly checking session id of victim as current session
Currently for the module cfn__resource_injection takes two input
- s3-access-key : Victims key
- attacker-key: Attackers key
In the code we are checking if current session is victims key or not and throwing an error. Victims key and Attacker key cannot have same pacu session at same time, we should just check if victims key exists in pacu database and use that as needed. Function get_aws_key_by_alias_from_db
checks if give key alias exists in db or not.
Pacu (attack:attack) > run cfn__resource_injection --attacker-key attack --s3-access-key victim
@RyanJarv Please review