A finance company moved its customer data and left something open to the internet. Your job: find it, see what leaked, and learn how to close it.
Open your wallet in minutes and apply for personal financing from your phone.
Open your walletThis is a snapshot of the company's website. You can't browse it, but anything visible here could be a clue.
Waha Finance is a startup offering digital wallets and personal financing. Last week they moved customer data to a new system and asked you, as a cybersecurity consultant, to make sure nothing is exposed.
You have no permissions and no passwords. Just a browser, like anyone on the internet.
Your progress is saved in this browser only. Create a free account to keep it and continue from any device.
Images on a website have to be stored somewhere… where?
Found it: the image URL reveals the bucket name.
backups folder?The URL you found points to a file. What if you go one level up?
One file — and the bucket lists its contents to anyone.
Customers' personal and financial data. A leak exposes them to fraud and violates the Personal Data Protection Law.
Read the folder names. Where might employees write notes?
Each <Key> in the XML page is a file path. Try adding it to the end of the bucket URL.
Correct flag.
It blocks any access that is "public".
Block Public Access.
All of them apply together.
You found the gap, understood the risk, and learned how to close it. That's exactly what a cloud security consultant does.
Continue to LAB-02: The Excess PermissionWaha Finance is a fictional company for educational purposes; any resemblance to a real organization is unintended. All data in this lab is a synthetic dataset. Only use these skills on systems you're authorized to test.