attacking-serverless

Attacking Serverless

Serverless changes the attack surface from hosts to events. There is no SSH, no persistent shell, no OS to enumerate in the traditional sense. The execution environment is ephemeral, but the IAM role attached to it is not, and that role is almost always the real target. A compromised Lambda function does not give you a server — it gives you a set of AWS credentials that refresh automatically, have no MFA, and were scoped by a developer who optimized for "make it work" rather than least privilege. The same pattern holds across Azure Functions, GCP Cloud Functions, and edge runtimes, with minor variation in where the credentials live and how the isolation boundary is drawn.

When to Use

• The target runs AWS Lambda, Azure Functions, GCP Cloud Functions, or Cloudflare Workers
• API Gateway, Azure API Management, or GCP API Gateway fronts serverless compute
• Event-driven architectures process input from S3, SQS, SNS, EventBridge, Pub/Sub, or Storage triggers
• You need to test the execution role or managed identity attached to a function
• Step Functions, Durable Functions, or Cloud Workflows orchestrate serverless components
• Function URLs or HTTP triggers are exposed without an authorizer

When NOT to Use

• IAM-only without serverless compute — use exploiting-cloud-platforms for general cloud IAM enumeration and privilege escalation
• API Gateway as a REST API where the backend is containers or VMs — use testing-apis for the API methodology
• Source code review of function code without runtime access — use auditing-code-for-vulnerabilities for static analysis

Reconnaissance

Discover functions before you attack them. The function name, runtime, handler, event sources, and attached role are all enumerable from the cloud control plane or from the application itself.

# AWS — list functions and their configurations
aws lambda list-functions --query 'Functions[*].[FunctionName,Runtime,Role,Handler]' --output table
aws lambda list-event-source-mappings --function-name TARGET_FUNCTION
aws apigateway get-rest-apis
aws apigatewayv2 get-apis

# Azure
az functionapp list --query '[].{name:name, runtime:siteConfig.linuxFxVersion, rg:resourceGroup}' -o table
az functionapp function list --name APP_NAME --resource-group RG

# GCP
gcloud functions list --format='table(name,runtime,entryPoint,trigger)'
gcloud functions describe FUNCTION_NAME