Scenario: Incognito Travel

[TeneBrae93]

New Scenario - Incognito Travel

New scenario focused on Incognito misconfigurations (different than the other Incognito one). The attack path is based on this blog/research by Cobalt - https://www.cobalt.io/blog/full-account-takeover-via-aws-cognito-misconfiguration -- I also updated .gitignore to ignore common LLM files (I used Gemini for some of the terraform code).

Scenario: Incognito_Travel

Size: Medium

Difficulty: Easy

Command: ./cloudgoat.py create incognito_travel

Scenario Resources

• 1 Cognito User Pool
• 1 Cognito User Pool Client
• 1 Lambda Function (Backend API)
• 1 API Gateway
• 1 S3 Bucket (Frontend Static Site)

Scenario Start(s)

1. URL of the "Incognito Travel" website.

Scenario Goal(s)

Gain unauthorized access to the account of cory@hacksmarter.hsm on the travel portal.

Summary

In this scenario, you start as an external attacker with limited AWS credentials. Your primary target is the "Incognito Travel" portal. Through careful enumeration and exploitation of a misconfigured Cognito User Pool, you will discover a way to manipulate user attributes and bypass identity verification through email normalization inconsistencies, eventually taking over a high-value user account.

Walkthrough - Cognito Attribute Takeover

A detailed cheat sheet & walkthrough for this route is available here.

[TeneBrae93]

I am dumb. I meant to say Cognito vulnerabilities (not Incognito). I was confusing myself based on the name of my own scenario 😅