> For the complete documentation index, see [llms.txt](https://security-notes.gitbook.io/security-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://security-notes.gitbook.io/security-notes/cloud-aws/lambda-function/attacking-apis.md).

# Attacking APIs

## Bypass IP based filters

It is possible to create a proxy to expose traffic and bypass security checks on API endpoints and resources. This can be achieved using [FireProx](https://github.com/ustayready/fireprox)

### Installation

```
git clone https://github.com/ustayready/fireprox
cd fireprox
pip3 install -r requirements.txt
```

If you are installing the tool on a local machine as opposed to Cloudshell instance, you need to configure AWS account access using `aws configure` or the following commands

```
export AWS_SECRET_ACCESS_KEY=<access key value>
export AWS_ACCESS_KEY_ID=<access key name>
#needed only if current access key is temporary (key starts with ASIA)
export AWS_SESSION_TOKEN=<session token>
```

### Manage gateways

Create gateway

```
python fire.py --command create --url <url to expose>
```

List Gateways

```
python fire.py --command list
```

Delete gateway

```
 python3 fire.py --command delete --api_id <id>
```