Hacking the Cloud is an open-source encyclopedia of offensive security techniques that can be used in cloud environments.
External link for Hacking the Cloud
Arlington, Virginia, US
Hacking the Cloud reposted this
As the year comes to a close it's time to look back on all that has happened. It was a big year for Hacking the Cloud, this was the first time we crossed 100,000 visitors. In addition, for the first time ever "SSRF to the metadata service" was NOT the top article on Hacking the Cloud! What was? You'll have to read the post to find out. Happy holidays everyone! https://lnkd.in/gtEM7ark
Simplify your AWS CLI workflows with practical tips! Use - to directly interact with S3 objects—no local files required. For API call tracking, learn how to append metadata to the CloudTrail log User-Agent using AWS_EXECUTION_ENV. These techniques enhance productivity and logging clarity for AWS users. Read more:
AWS Cognito is designed to block account enumeration via its "Prevent user existence errors" setting, but a gap in its coverage leaves usernames vulnerable to enumeration through cognito-idp:SignUp API calls. This flaw complicates detection due to sparse CloudTrail logs, but spikes in unconfirmed accounts can indicate abuse. Dive into the issue, its implications, and ways to mitigate the risk:
Hacking the Cloud reposted this
New on Hacking the Cloud: Misconfigured OIDC trusting roles in AWS? Easy initial access. Eduard Agavriloae shares how to exploit IAM roles that are misconfigured to trust Terraform Cloud. As in....anyone's Terraform cloud. Happy holidays and happy hacking! https://lnkd.in/eKnE-jpk
AWS Cognito Identity Pools are powerful, but misconfigurations can lead to excessive privileges, turning them into a vulnerability. Attackers exploiting these pools can access sensitive data, manipulate services, or escalate privileges using temporary AWS credentials. By adhering to the principle of least privilege and securing IAM roles, you can reduce exposure to these risks. Learn how these misconfigurations happen and how to safeguard your environment.
Hacking the Cloud reposted this
New on Hacking the Cloud! Eduard Agavriloae wrote a playbook for exploiting AWS services due to misconfigured resource policies! S3, AMIs, SNS, SQS, ECR, Lambda, and more! https://lnkd.in/gWuGDAM7
Nick Frichette’s research explores how access to an EC2 instance can open the door to intercepting and modifying AWS SSM communications. By spoofing the SSM Agent, attackers can manipulate messages or sessions, offering insight into the risks and potential mitigations for cloud environments. Tools like ssm-send-command-interception highlight the techniques involved. Learn more in this detailed write-up:
When AWS credentials are compromised, understanding their permissions is crucial. Enter enumerate-iam: a non-destructive brute-force tool that tests safe API calls to identify accessible actions. Be aware, though—it generates significant CloudTrail logs, so plan carefully to avoid detection. Learn how to leverage this tool while managing OPSEC risks effectively. Full breakdown:
AWS Organizations simplifies multi-account management, but its defaults can be a double-edged sword. If attackers gain control of the management account, they can leverage default settings to access all member accounts. Learn about the paths for lateral movement, the significance of trusted/delegated access, and actionable steps to secure your AWS setup. This is a must-read for cloud security professionals: