AWS Cognito
Summary: A Burp Suite extension by Nick Coblentz, version 0.1.7 and last updated 13 December 2023, identifies key information from requests to AWS Cognito, provides several passive scan checks, and suggests HTTP request templates for exploiting several known vulnerabilities. PortSwigger states that extensions are written by third-party Burp users and that it makes no warranty about their quality or usefulness for any particular purpose.
Key Takeaway: The tooling to fingerprint AWS Cognito traffic and template exploits against its known vulnerabilities is packaged as a free, third-party Burp extension - so the same checks are available to anyone probing your identity layer, not just your testers.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026