Skill: edge-computing-security
Summary
Edge computing security testing covering CDN bypass, Cloudflare Workers abuse, AWS Lambda@Edge attacks, cache poisoning, origin IP discovery, WAF bypass, and edge function injection.
Tools: garak, PyRIT, promptfoo, custom harnesses
Domain: edge
MITRE: TA0001-Initial Access, T1190-Exploit Public-Facing App
Description
Edge computing security testing covering CDN bypass, Cloudflare Workers abuse, AWS Lambda@Edge attacks, cache poisoning, origin IP discovery, WAF bypass, and edge function injection.
This skill covers the offensive side of cdn-edge security, including reconnaissance, vulnerability discovery, exploitation, persistence, and reporting. Aligned with OWASP Top 10, MITRE ATT&CK, and industry-specific compliance frameworks.
Use Cases
- CDN/WAF bypass: Bypass CDN to attack origin directly.
- Edge function exploitation: Abuse Cloudflare Workers, Lambda@Edge for code execution at edge.
- Cache poisoning: Poison cached responses to affect all users.
- Origin IP discovery: Find direct IP to bypass CDN/WAF.
- Edge persistence: Maintain persistence via edge functions (survives origin compromise).
Core Tools
| Cloudflare wrangler | Workers development/deploy | wrangler deploy |
| serverless-cli | Multi-cloud serverless | serverless deploy |
| waf-bypass | WAF bypass payloads | Various scripts |
| Curl with resolver | Origin IP discovery | curl --resolve target.com:443:ORIGIN_IP |
| Burp Suite Collaborator | Cache poisoning | Out-of-band detection |
| DNS recon | Origin IP discovery | dig, dnsrecon |
| Nmap | Direct origin scan | nmap -sS ORIGIN_IP |
Methodology
Attack Chain
[1] CDN Detection [2] Origin Discovery [3] Bypass WAF - Cloudflare/Akamai/etc - DNS history (SecurityTrails) - Origin direct - Worker script analysis - SSL cert SAN - HTTP/2 multiplexing - Edge function audit - HTTP headers leak | - Cache key analysis - IP blocks (Shodan) v | v [4] Exploitation v [2.5] WAF fingerprint - Edge function RCE [1.5] Cache analysis - Rule identification - Cache poisoning - Cache key structure - Bypass technique - Origin compromise - TTL behavior | | v v [5] Persistence [6] Reporting - Edge function - CDN config audit - Worker script - Origin compromise - Cache poisoning - WAF effectiveness
Defense Perspective
| Defense Layer | Measures | Key Points |
|---|---|---|
| CDN/WAF Configuration | Strict origin policy; WAF rule set; rate limiting | CDN is first line of defense; configure properly |
| Origin Protection | Origin only accessible via CDN (IP allowlist); no direct internet | If origin IP leaks, attacker bypasses CDN entirely |
| Cache Security | Proper cache key (include auth header); cache key sanitization | Cache poisoning affects all users; cache key is critical |
| Edge Function Security | Sandbox edge functions; least privilege; secret scanning | Edge functions have CDN-wide impact; sandbox is essential |
| TLS Configuration | Modern TLS (1.3); HSTS; certificate pinning | TLS downgrade allows interception; HSTS prevents |
| Origin Network | Origin in private subnet; security group allows only CDN | Network-level protection; deny direct access |
Practical Steps
See
payloads.mdfor detailed payloads andtest-cases.mdfor the complete test checklist.
1. Reconnaissance
Identify target infrastructure; fingerprint products; enumerate attack surface.
2. Vulnerability Discovery
Run automated scanners (garak, PyRIT); manual testing per OWASP Top 10.
3. Exploitation
Chain vulnerabilities for maximum impact; document PoC.
4. Persistence
Establish persistence via configuration changes, scheduled tasks, or backdoors.
5. Reporting
Map findings to MITRE ATT&CK, OWASP, regulatory frameworks; include concrete remediation.
Detection Methods
CDN / Edge Function Logs
- Cloudflare Workers abuse: Anomalous Worker invocations; outbound fetch to attacker domains.
- AWS Lambda@Edge anomalies: Function duration spikes; cross-region data egress from edge.
- Origin IP discovery: Direct origin access bypassing CDN (signature: requests to origin IP from internet).
SIEM Detection Rules
- Splunk SPL:
index=cdn sourcetype=cloudflare:workers | stats count by script | sort -count | head 10 - Cloudflare Analytics: Native bot/security analytics.
- AWS CloudTrail: Lambda@Edge invocation logs.
Defense Evasion Techniques
CDN Bypass
- Direct origin access: Find origin IP via DNS history, leak in HTTP headers, SSL cert; bypass CDN/WAF.
- Cache poisoning: Poison cached response; affect all users.
- Cache deception: Trick CDN into caching dynamic content with sensitive data.
Edge Function Exploitation
- Worker script injection: Inject code into Worker via compromised account or supply chain.
- Lambda@Edge privilege abuse: Use Lambda@Edge for global execution.
- Origin IP rotation: Use direct IP for exfil; CDN sees only legitimate traffic.
Common Pitfalls
- Testing in unauthorized environments
- Ignoring rate limiting (will get blocked)
- Single-shot testing (real attacks are sustained)
- Neglecting supply chain
- Forgetting monitoring/alerting
Reporting and Documentation
Reports should include CVSS scores, MITRE ATT&CK mapping, concrete PoC, business impact, and specific remediation.
Legal and Ethical Considerations
Ensure proper authorization before testing. Document scope in engagement letter. Some attack techniques may violate local laws (e.g., radio transmission without license).
Hacker Laws
| Law | Application |
|---|---|
| Trust but Verify | Verify all outputs; verify all sources |
| First Principles | Understand underlying protocols before attacking |
| Defense in Depth | Multiple layers required for robust defense |
| Assume Breach | Design assuming attacker already inside |
| Minimize Attack Surface | Reduce unnecessary features/exposure |
Learning Resources
Skill supplementary files: payloads.md, test-cases.md
External Resources:
- OWASP Top 10
- MITRE ATT&CK
- Industry-specific compliance frameworks
