EXPLORING RED TEAM PERSISTENCE VIA AWS LEX CHABOT’S

Summary from the TLDR InfoSec newsletter

This blog post explores how attackers can hijack AWS Lex Chabots with a “sleeper phrase” that returns the Lambda function’s role credentials. The post goes through the process of debugging to find the relevant intent file to update and the correct formatting to have Lex return the message properly.