$#cloud

2 writeups

Dark blue hooded mascot wearing sunglasses and a gold Bitcoin chain

TryHackMeMedium04 Aug 2026

Hacker Holidays — Day 9: Crypto Cabana

An Azure static website leaks an over-scoped account SAS token, which exposes a hidden storage container holding service-principal credentials — and from there, a Key Vault secret whose "rotated" value is still recoverable in its previous version.

#hacker-holidays
#azure
#cloud
#sas-token

Pink ghost mascot wearing sunglasses and holding a phone

TryHackMeEasy29 Jul 2026

Hacker Holidays — Day 3: Complimentary

A "free" wellness app hands out unauthenticated Cognito guest credentials, and an over-scoped IAM role lets those guest credentials Scan the entire DynamoDB table instead of just one record.

#hacker-holidays
#cloud
#aws
#idor