{
  "id": 7397432,
  "title": "I Attacked My Own AWS API Four Times, Then Fixed It, and Wrote Down Everything",
  "url": "https://urgent.news/2026/09/14/i-attacked-my-own-aws-api-four-times-then-fixed-it-and-wrote-down",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-14T20:47:44.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/yvan_saf_ffc94f53623480b1/i-attacked-my-own-aws-api-four-times-then-fixed-it-and-wrote-down-everything-3a52"
  },
  "original_language": "en",
  "account": "In a recent experiment, a reporter intentionally attacked a serverless Todo API twice on the same AWS account, once with no security measures and the other hardened. The reporter then documented the results, highlighting the importance of proper security measures. The application consisted of a simple Todo API with create, list, read, update, and delete functions for tasks. Both versions were built with the same basic structure: Client → API Gateway → Lambda → DynamoDB. The reporter conducted two attacks: enumeration and stored cross-site scripting (XSS). Enumeration involved retrieving all database records without authentication, as the vulnerable version lacked authentication and authorization checks. In contrast, the hardened version used a Lambda Authorizer to verify a signed token before allowing access to the handler. The second attack, stored XSS, demonstrated how an application can accept user input, store it, and later display it without validating if it's safe to do so. The reporter inserted malicious code into the API, which was stored unchanged in the database. This malicious code could then be executed by another user when they accessed the data. The reporter emphasized that this is a common security issue known as stored XSS. By conducting these attacks, the reporter aimed to underscore the need for proper security measures, such as authentication, authorization, and input validation, to protect against potential threats in cloud applications.",
  "summary": "A few months ago I got tired of hearing the same sentence in interviews and student forums: \" we're on the cloud, so we're secure. \" I understand where it comes from. AWS handles the physical data centers, the hypervisor, the network backbone, a huge amount of infrastructure most of us never think about. But the Shared Responsibility Model draws a line, and everything on your side of that line,…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}