Stealing OAuth Github Tokens with AWS CodeBuild

Carlos Polop from HALBORN showcases his technique to exfiltrate Github tokens via the AWS CodeBuild cloud service, with a custom Docker container to man-in-the-middle the OAuth credentials!

You can learn more about Carlos Polop, Ignacio Dominguez or the security audits and assessments that HALBORN performs at https://j-h.io/halborn

Check out the vulnerability disclosure writeup from HALBORN: https://www.halborn.com/blog/post/halborn-discovers-and-discloses-vulnerability-in-aws-code-build

00:00 Preview
00:20 Introduction with Carlos & Ignacio
01:00 AWS CodeBuild Background
02:12 CodeBuild and GitHub Mishaps
05:12 Execute CodeBuild within a Docker Container …

amp aws cloud cloud service container credentials demo docker github halborn introduction man-in-the-middle oauth preview service stealing tokens