Byte Lotus Wellness - A Deep Dive into Misconfigured AWS Permissions
TryHackMe Challenge Write-Up
Learn how an unauthenticated guest role in AWS can expose sensitive data - step by step.
The challenge presents a wellness app that promises "complimentary access" without any login or sign-up. Upon opening the web page, the app magically "knows" you and displays your wellness profile. But how? And what else can you access?
The goal: find out how the app knows anything about you, and see what else it's willing to hand over.
