def lambda_handler(event, context): token = event[‘authorizationToken’] method_arn = event[‘methodArn’]

if not token: return { ‘statusCode’: 401, ‘body’: ‘Unauthorized’ }

try:

Replace this with your own token validation logic

if token == “your-secret-token”: return generate_policy(‘user’, ‘Allow’, method_arn) else: return generate_policy(‘user’, ‘Deny’, method_arn) except Exception as e: print(e) return { ‘statusCode’: 500, ‘body’: ‘Internal Server Error’ }

def generate_policy(principal_id, effect, resource): policy = { ‘principalId’: principal_id, ‘policyDocument’: { ‘Version’: ‘2012-10-17’, ‘Statement’: [ { ‘Action’: ‘execute-api:Invoke’, ‘Effect’: effect, ‘Resource’: resource } ] } } return policy

</details>

调用它时可以使用类似以下的命令：

<pre class="language-bash" data-overflow="wrap"><code class="lang-bash"><strong>curl "https://jhhqafgh6f.execute-api.eu-west-1.amazonaws.com/prod/custom_auth" -H 'Authorization: your-secret-token'
</strong></code></pre>

> [!WARNING]
> 根据Lambda代码，这个授权可能存在漏洞

请注意，如果生成并返回了**拒绝策略**，API Gateway返回的错误是：`{"Message":"User is not authorized to access this resource with an explicit deny"}`

这样你可以**识别出这个授权**的存在。

### 所需的API密钥

可以设置需要**有效API密钥**才能联系的API端点。

<figure><img src="../../../images/image (88).png" alt=""><figcaption></figcaption></figure>

可以在API Gateway门户中生成API密钥，甚至可以设置其使用量（每秒请求数和每月请求数）。

要使API密钥生效，需要将其添加到**使用计划**中，该使用计划必须添加到**API阶段**，并且相关的API阶段需要为需要API密钥的**端点**配置**方法限流**：

<figure><img src="../../../images/image (198).png" alt=""><figcaption></figcaption></figure>

## 未经身份验证的访问

<a class="content_ref" href="../aws-unauthenticated-enum-access/aws-api-gateway-unauthenticated-enum/index.html"><span class="content_ref_label">AWS - API Gateway Unauthenticated Enum</span></a>

## 权限提升

<a class="content_ref" href="../aws-privilege-escalation/aws-apigateway-privesc/index.html"><span class="content_ref_label">AWS - Apigateway Privesc</span></a>

## 后期利用

<a class="content_ref" href="../aws-post-exploitation/aws-api-gateway-post-exploitation/index.html"><span class="content_ref_label">AWS - API Gateway Post Exploitation</span></a>

## 持久性

<a class="content_ref" href="../aws-persistence/aws-api-gateway-persistence/index.html"><span class="content_ref_label">AWS - API Gateway Persistence</span></a>

> [!TIP]
> 学习并练习 AWS Hacking:<img src="../../../../../images/arte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://hacktricks-training.com/courses/arte)<img src="../../../../../images/arte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">\
> 学习并练习 GCP Hacking: <img src="../../../../../images/grte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">[**HackTricks Training GCP Red Team Expert (GRTE)**](https://hacktricks-training.com/courses/grte)<img src="../../../../../images/grte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">\
> 学习并练习 Az Hacking: <img src="../../../../../images/azrte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">[**HackTricks Training Azure Red Team Expert (AzRTE)**](https://hacktricks-training.com/courses/azrte)<img src="../../../../../images/azrte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">
>
> <details>
>
> <summary>支持 HackTricks</summary>
>
> - 查看 [**subscription plans**](https://github.com/sponsors/carlospolop)!
> - **加入** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) 或者 [**telegram group**](https://t.me/peass) 或 **关注** 我们的 **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
> - **通过向** [**HackTricks**](https://github.com/carlospolop/hacktricks) 和 [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github 仓库 提交 PRs 来分享 hacking tricks。
>
> </details>