🧩 When too much access is not enough: a story about Confluence and tokens

During a Red Team engagement, we compromised an AWS account containing a Confluence instance hosted on an EC2 virtual machine. Although we fully compromised the machine hosting the Confluence instance, we did not have valid credentials to log in but were able to interact with the underlying database. This led us to study the structure of the Confluence database and the mechanism for generating API tokens.

P.S. Еще несколько полезных ссылок со старого канала:

📜 Creating a Malicious Atlassian Plugin
🔗 Malfluence
A PoC for a malicious Confluence plugin, which can access all content inside a Confluence instance, access the database directly, and execute arbitrary commands on the underlying Linux server.

📜 Stealing All of the Confluence Things
🔗 Conf-Thief
A Red Team tool for exfiltrating sensitive data from Confluence pages.

🔗 AtlasReaper
A command-line tool for reconnaissance and targeted write operations on Confluence and Jira instances.

🔗 Jecretz
Jira Secret Hunter - Helps you find credentials and sensitive contents in Jira tickets.