Skip to content
HackIndex logo

HackIndex

SQS and SNS Enumeration

2 min read May 24, 2026

SQS queues and SNS topics often carry application data — order records, user events, internal messages. Overpermissive access policies allow any IAM principal (or even anonymous users) to read or publish.

SQS

List Queues

┌──(kali㉿kali)-[~]
└─$ aws sqs list-queues --profile $PROFILE --region $REGION

Get Queue Attributes

Reveals the queue ARN, approximate message count, and access policy:

┌──(kali㉿kali)-[~]
└─$ aws sqs get-queue-attributes --queue-url $QUEUE_URL --attribute-names All --profile $PROFILE --region $REGION

Read Messages

If you have sqs:ReceiveMessage:

┌──(kali㉿kali)-[~]
└─$ aws sqs receive-message --queue-url $QUEUE_URL --max-number-of-messages 10 --profile $PROFILE --region $REGION

Messages are not deleted by receiving them unless you explicitly delete them. Read safely without disrupting the queue.

Queue Access Policy

┌──(kali㉿kali)-[~]
└─$ aws sqs get-queue-attributes --queue-url $QUEUE_URL --attribute-names Policy --profile $PROFILE --region $REGION | jq -r '.Attributes.Policy | fromjson'

"Principal": "*" with "Effect": "Allow" on sqs:SendMessage or sqs:ReceiveMessage = anyone can read or write.

SNS

List Topics

┌──(kali㉿kali)-[~]
└─$ aws sns list-topics --profile $PROFILE --region $REGION --query 'Topics[*].TopicArn' --output table

Get Topic Attributes

┌──(kali㉿kali)-[~]
└─$ aws sns get-topic-attributes --topic-arn $TOPIC_ARN --profile $PROFILE --region $REGION

Check Policy for "Principal": "*" entries.

List Subscriptions

┌──(kali㉿kali)-[~]
└─$ aws sns list-subscriptions-by-topic --topic-arn $TOPIC_ARN --profile $PROFILE --region $REGION --query 'Subscriptions[*].{Protocol:Protocol,Endpoint:Endpoint,Status:SubscriptionArn}' --output table

Subscriptions expose:

  • https endpoints receiving event data (internal webhook URLs, microservice endpoints)

  • email addresses (internal team aliases)

  • lambda ARNs (Lambda functions triggered by this topic)

  • sqs ARNs (cross-topic fan-out)

  • http endpoints (unencrypted — look for internal IPs)

Cross-Account Subscriptions

┌──(kali㉿kali)-[~]
└─$ aws sns list-subscriptions --profile $PROFILE --region $REGION | jq '.Subscriptions[] | select(.TopicArn | split(":")[4] != (.Endpoint | split(":")[4] // ""))'

Cross-account subscriptions mean messages from this topic flow to a different AWS account — relevant for understanding data flows and lateral paths.

Publish to a Topic

If you have sns:Publish:

┌──(kali㉿kali)-[~]
└─$ aws sns publish --topic-arn $TOPIC_ARN --message "test" --profile $PROFILE --region $REGION

Publishing to an SNS topic that triggers Lambda functions or SQS processors can reach application logic and test injection paths.