🚀 Submit a Challenge — SecDim AppSec Village CTF at DEF CON 34 and Win a ROG Xbox Ally

Sign InContact sales
Sign InContact sales

Capital One Leak

4h 20mIntermediateJavaC#JavaScriptPythonGoTypeScript

Personal data of 100 million Americans and 6 million Canadians was disclosed due to a security bug in a program running on a Capital One AWS EC2 instance. The security bug allowed the adversary to hijack an AWS IAM access token and use it to download and decrypt data from a sensitive S3 bucket. This security bug has become common in many programs due to the shift towards Microservice Architecture and the increased usage of public clouds; let's find out what this bug is and how to avoid it in our programs.

Begin course

Topics

  1. Introduction

    Lesson15m

    Back in July 2019, a big security problem hit Capital One, a big money company in the USA. Around 100 million Americans and six million Canadians had their personal information exposed, and more than 100 million credit card applications were illegally accessed. Someone sent an email to tell the company that the data was out there for anyone to see on Github.

  2. Server Side Request Forgery

    Lab40m

    Let’s head to the lab to discover, debug, and fix this vulnerability within an actual application.

    PythonJavaScriptTypeScriptGoJavaCsharp

  3. Lessons learnt

    Lesson5m

    SSRF is an old security problem that's become more frequent because of new ways we build software. When we split tasks into smaller services or use outside APIs with the HTTP messaging system, it creates new chances for attackers to use SSRF.