Identifying entry points on AWS, Azure and GCP

Table of Contents

Identifying entry points on AWS, Azure and GCP

This blog is mainly a list of Tools to expose and test entry points into AWS, Azure and GCP. My next goal is to implement these tools and develop some youtube videos. Then after that develop actual detection and mitigation strategies.

AWS Security Tools

AWS – Easy to get started, changes daily, difficult to secure and harder to know if you are “doing it right’. AWS has 1000s of APIs, are you confident there are all secure? Have a good nights sleep.

AWS innovates really quickly. AWS send out a lot of new features that continually change the game in terms of how a central security team can approach security, monitor security, or author their permissions. Keeping up with all of this game-changing information is really, really hard. I follow Twitter and the What’s New announcements for up to date information, and of course the AWS Security Blog; https://twitter.com/awssecurityinfo?lang=en

Research Articles

Top 20 Microsoft Azure Misconfigurationshttps://www.infosecmatter.com/top-20-microsoft-azure-vulnerabilities-and-misconfigurations/
Incident Response In A Microsoft Cloud Environment
- https://m365internals.com/2021/04/17/incident-response-in-a-microsoft-cloud-environment/
CloudSecDocs
- https://cloudsecdocs.com/
AWS Lambda
- https://d1.awsstatic.com/whitepapers/Overview-AWS-Lambda-Security.pdf
AWS Inspector Network Reachability can find some of this as well.
- https://aws.amazon.com/blogs/aws/identify-unintended-resource-access-with-aws-identity-and-access-management-iam-access-analyzer/
AWS Penetration Testing with Kali (Boto3 and Pacu)
- https://learning.oreilly.com/library/view/hands-on-aws-penetration/9781789136722/b333e411-e173-4bbd-8954-85f8a1ede9b2.xhtml
- Using Boto3 and Pacu to Maintain AWS Persistence
- https://subscription.packtpub.com/book/virtualization_and_cloud/9781789136722/11
- https://learning.oreilly.com/library/view/hands-on-aws-penetration/9781789136722/7ba97c2d-2afb-4b15-9912-b5841ddeb325.xhtml
- https://subscription.packtpub.com/book/virtualization_and_cloud/9781789136722/10/ch10lvl1sec70/using-the-boto3-library-for-reconnaissance
- https://medium.com/cloud-security/aws-iam-role-profiles-with-boto3-a1ce1e8c27b3
AWS Policy evaluation
- https://policysim.aws.amazon.com/home/index.jsp?#
- https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html#policy-eval-denyallow
Hide Kali linux and Boto from AWS GuardDuty
- https://www.thesubtlety.com/post/patching-boto3-useragent/
Hacking in the Cloud
- https://hackingthe.cloud/aws/
- https://www.lastweekinaws.com/podcast/screaming-in-the-cloud/hacking-aws-in-good-faith-with-nick-frichette/
Hacking with AWS Lambda and Python
- https://www.rackspace.com/en-au/blog/the-devnull-s3-bucket-hacking-with-aws-lambda-and-python
Bypassing GuardDuty Pentesting
- https://www.linkedin.com/pulse/bypass-guardduty-pentest-alerts-nick-frichette/
Enumerating Lambda functions for Pentesting
- https://riyazwalikar.github.io/pentestawslambda/#/4/2
- http://blog.blueinfy.com/2018/07/enmerating-lambda-functions-for.html

CapitalOne – SRE exploits
Playing with CloudGoat part 1: hacking AWS EC2 service for privilege escalation
- https://rzepsky.medium.com/playing-with-cloudgoat-part-1-hacking-aws-ec2-service-for-privilege-escalation-4c42cc83f9da
Data leaks from AWS EC2 — how can Bob reveal Alice’s secrets
- https://medium.com/securing/data-leaks-from-aws-ec2-how-can-bob-reveal-alices-secrets-bd6fbe389966
AWS Digital Forensics / How to Perform a Security Investigation in AWS A SANS Whitepaper
AWS Penetration testing with Kali Linux
Working with open-source tools for Traffic Mirroring
- https://docs.aws.amazon.com/vpc/latest/mirroring/tm-example-open-source.html
Playing with CloudGoat part 5: hacking AWS with Pacu
- https://rzepsky.medium.com/playing-with-cloudgoat-part-5-hacking-aws-with-pacu-6abe1cf5780d
Privilege Escalation in AWS with PassRole Attacks
- https://www.praetorian.com/blog/privilege-escalation-in-aws-with-passrole-attacks
SEC588 Cloud Penetration Testing: What is Cloud Pen Testing and why is it different?
- https://www.youtube.com/watch?v=lOhvIooWzOg
Penetration Testing AWS Storage: Kicking the S3 Bucket
- https://rhinosecuritylabs.com/penetration-testing/penetration-testing-aws-storage/
AWS IAM Privilege Escalation – Methods and Mitigation
- https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/
- https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2
Confused Deputy Attack
- Example Corp requires access to certain resources in your AWS account. But in addition to you, Example Corp has other customers and needs a way to access each customer’s AWS resources. Instead of asking its customers for their AWS account access keys, which are secrets that should never be shared, Example Corp requests a role ARN from each customer. But another Example Corp customer might be able to guess or obtain your role ARN. That customer could then use your role ARN to gain access to your AWS resources by way of Example Corp. This form of permission escalation is known as the confused deputy problem.
AWS GuardDuty findings.
- https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-active.html
AWS Incident Response and Memory capture of EC2 instances;
AWS security audit guidelines
- https://docs.aws.amazon.com/general/latest/gr/aws-security-audit-guide.html
Automatically Rotate AWS Keys
Lesser Known Techniques for Attacking AWS Environments
- https://tldrsec.com/blog/lesser-known-aws-attacks/

https://twitter.com/dagrz/status/1336960817669914624?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1336960817669914624%7Ctwgr%5E%7Ctwcon%5Es1_&ref_url=https%3A%2F%2Ftldrsec.com%2Fblog%2Flesser-known-aws-attacks%2F
Cyberware labs
- https://cyberwarfare.live/AWSCloudRedTeamLab.php?fbclid=IwAR3-aU-0_lrLTeTkdzTHZbFoAIbYjeyRSksnvFWcnY69hXhpPEQttjDEqjA
- https://cyberwarfare.live/Study-Material/CARTS/CARTS-Course-Contents.pdf?fbclid=IwAR2im83XHT72zfH0i6f6k89jhFBa5xLhodI_kAjFBpslFwYfdV2uKYDLcN4
Exploit AWS EC2 metadata service (IMDSv1/IMDSv2)
- https://blog.christophetd.fr/abusing-aws-metadata-service-using-ssrf-vulnerabilities/
- https://github.com/rapid7/metasploit-framework/blob/master//modules/post/multi/gather/aws_ec2_instance_metadata.rb
- https://medium.com/@anunayb007/ssrf-attack-on-aws-technical-demo-for-stealing-ec2-metadata-4910dafafdee
- https://rhinosecuritylabs.com/cloud-security/aws-security-vulnerabilities-perspective/
- https://attackiq.com/2020/04/06/defeating-a-cloud-breach-part-2/
- https://hackerone.com/reports/53088
- https://blog.appsecco.com/server-side-request-forgery-ssrf-and-aws-ec2-instances-after-instance-meta-data-service-version-38fc1ba1a28a
- https://www.mcafee.com/blogs/enterprise/cloud-security/how-an-attacker-could-use-instance-metadata-to-breach-your-app-in-aws/
- https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service/
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html
- https://javiergodinez.com/wp/?p=70
- iptables -A OUTPUT -m owner ! –uid-owner root -d 169.254.169.254 -j DROP
- aws ec2 modify-instance-metadata-options \ –instance-id i-1234567898abcdef0 \ –http-endpoint disabled
- https://aws.amazon.com/about-aws/whats-new/2019/11/announcing-updates-amazon-ec2-instance-metadata-service/
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-data-retrieval.html
  - Limiting instance metadata service access You can consider using local firewall rules to disable access from some or all processes to the instance metadata service.
  - sudo iptables –append OUTPUT –proto tcp –destination 169.254.169.254 –match owner –uid-owner apache –jump REJECT
Cloud Security Testing
- https://www.linkedin.com/video/live/urn:li:ugcPost:6753214425890746368/
- Detect open SQS queues or S3 buckets
- https://daycyberwox.com/exploiting-aws-2-attackers-perspective-flaws2cloud
IAM role enumerations
- https://gist.github.com/kmcquade/4d5788f8592953f5a3a65ec3f87385b4
How to approach threat modeling
- https://aws.amazon.com/blogs/security/how-to-approach-threat-modeling/
Escaped Docker in Azure Functions
- https://www.intezer.com/blog/research/how-we-escaped-docker-in-azure-functions/
Cloud MITRE Matrix
- https://attack.mitre.org/matrices/enterprise/cloud/
Blind Spots in the Cloud
- https://www.crowdstrike.com/blog/beware-blind-spots-in-the-cloud/
RhinoSecurity
- https://rhinosecuritylabs.com/cloud-security/privilege-escalation-google-cloud-platform-part-2/
AWS IAM Privilege Escalation – Methods and Mitigation
- https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/
FWDCloudSec
- https://fwdcloudsec.org/index.html#intro
- https://www.youtube.com/playlist?list=PLCPCP1pNWD7OBQvDY7vLCFhxWxok9DITl
Breaching The Cloud Perimeter w/ Beau Bullock
- https://www.blackhillsinfosec.com/breaching-the-cloud-perimeter-w-beau-bullock/
Exfiltration Paths in Isolated Environments using VPC Endpoints
- https://www.youtube.com/watch?v=mFK-GksgopI
prowler
- https://github.com/prowler-cloud/prowler

Security Terraform scripts;

Checkov is a static code analysis tool for infrastructure-as-code.
- https://github.com/bridgecrewio/checkov
tfsec uses static analysis of your terraform templates to spot potential security issues. Now with terraform CDK support.
- https://github.com/tfsec/tfsec
Terrascan is a static code analyzer for Infrastructure as Code.
- https://github.com/accurics/terrascan
TFLint is a framework and each feature is provided by plugins, the key features are as follows:
- https://github.com/terraform-linters/tflint

Known AWS breaches

Capital One
- https://twitter.com/0xdabbad00/status/1367504095012139014
- https://aws.amazon.com/blogs/security/setting-permissions-to-enable-accounts-for-upcoming-aws-regions/

Uber
- GitHub repo misconfig
Tesla
- Unsecured IT admin console
Dow Jones
- S3 bucket misconfig
WWE
BugBounties
- https://thezerohack.com/how-i-might-have-hacked-any-microsoft-account
Fuzzing AWS API
- https://frichetten.com/blog/xss_in_aws_console/

Tools

Identifying entry points on AWS, Azure and GCP