Skip to content
HackIndex logo

HackIndex

Lambda Function Enumeration

2 min read May 24, 2026

Lambda functions frequently store credentials in environment variables and run with overpermissioned execution roles. Function code itself often contains hardcoded secrets or internal API endpoints.

List Functions

┌──(kali㉿kali)-[~]
└─$ aws lambda list-functions --profile $PROFILE --region $REGION --query 'Functions[*].{Name:FunctionName,Runtime:Runtime,Role:Role,Modified:LastModified}' --output table

Get Function Configuration

Includes environment variables, execution role, timeout, memory, VPC config:

┌──(kali㉿kali)-[~]
└─$ aws lambda get-function-configuration --function-name $FUNCTION_NAME --profile $PROFILE --region $REGION

Environment variables are returned in plaintext if you have lambda:GetFunction or lambda:GetFunctionConfiguration:

┌──(kali㉿kali)-[~]
└─$ aws lambda get-function-configuration --function-name $FUNCTION_NAME --profile $PROFILE --region $REGION | jq '.Environment.Variables'

Common findings: DATABASE_URL, API_KEY, SECRET_KEY, AWS_ACCESS_KEY_ID, SLACK_TOKEN.

Download Function Code

Get a pre-signed URL to download the deployment package:

┌──(kali㉿kali)-[~]
└─$ aws lambda get-function --function-name $FUNCTION_NAME --profile $PROFILE --region $REGION | jq -r '.Code.Location'
┌──(kali㉿kali)-[~]
└─$ URL=$(aws lambda get-function --function-name $FUNCTION_NAME --profile $PROFILE --region $REGION | jq -r '.Code.Location')
┌──(kali㉿kali)-[~]
└─$ curl -s "$URL" -o function.zip
┌──(kali㉿kali)-[~]
└─$ unzip function.zip -d function_code/
┌──(kali㉿kali)-[~]
└─$ grep -r "key\|secret\|password\|token\|credential" function_code/ --include="*.py" --include="*.js" -i

Execution Role

The role ARN is in the function configuration. Enumerate what the role can do:

┌──(kali㉿kali)-[~]
└─$ aws iam get-role --role-name $ROLE_NAME --profile $PROFILE
┌──(kali㉿kali)-[~]
└─$ aws iam list-attached-role-policies --role-name $ROLE_NAME --profile $PROFILE

A Lambda execution role with iam:* or s3:* on * is a direct privilege escalation path. See IAM PassRole Lambda Escalation.

Layers

┌──(kali㉿kali)-[~]
└─$ aws lambda list-layers --profile $PROFILE --region $REGION
┌──(kali㉿kali)-[~]
└─$ aws lambda get-layer-version --layer-name $LAYER_NAME --version-number 1 --profile $PROFILE --region $REGION

Layers can contain shared libraries and configuration — worth downloading if accessible.

Event Source Mappings

Shows what triggers each function (SQS, DynamoDB streams, Kinesis, etc.):

┌──(kali㉿kali)-[~]
└─$ aws lambda list-event-source-mappings --function-name $FUNCTION_NAME --profile $PROFILE --region $REGION

Function URLs

Lambda function URLs expose functions directly over HTTPS without API Gateway. List them:

┌──(kali㉿kali)-[~]
└─$ aws lambda list-function-url-configs --function-name $FUNCTION_NAME --profile $PROFILE --region $REGION

Auth type NONE means the function is publicly invocable without any authentication.

Invoke a Function

If you have lambda:InvokeFunction:

┌──(kali㉿kali)-[~]
└─$ aws lambda invoke --function-name $FUNCTION_NAME --payload '{}' output.json --profile $PROFILE --region $REGION
┌──(kali㉿kali)-[~]
└─$ cat output.json

Useful for testing RCE paths or triggering functions that perform privileged actions.