cloud-security-pentest

| | Shared Responsibility Model | Cloud security framework where the provider secures infrastructure and the customer secures data, configurations, and access controls | | IMDS | Instance Metadata Service at 169.254.169.254 that provides instance identity, credentials, and configuration data; IMDSv2 requires token-based access | | Privilege Escalation | Exploiting IAM misconfigurations to elevate from limited permissions to administrative access within a cloud account | | Lateral Movement | Using compromised credentials or trust relationships to access resources in other accounts, VPCs, or cloud providers | | Pacu | Open-source AWS exploitation framework for penetration testing, providing modules for enumeration, escalation, and persistence | | ScoutSuite | Multi-cloud security auditing tool that collects configuration data and generates HTML reports with risk findings | | MITRE ATT&CK Cloud | Adversary tactics and techniques matrix specific to cloud environments including Initial Access, Execution, Persistence, and Exfiltration |

Tools & Systems

• Pacu: AWS-focused exploitation framework with modules for IAM enumeration, privilege escalation, and persistence testing
• ScoutSuite: Multi-cloud (AWS, Azure, GCP) security auditing tool generating comprehensive risk reports from API data collection
• CloudFox: AWS and Azure enumeration tool for identifying attack paths, privilege escalation vectors, and data access opportunities
• Prowler: Open-source cloud security assessment tool with 300+ checks across AWS, Azure, and GCP
• Cartography: Neo4j-based tool that maps relationships between cloud resources for visual attack path analysis

Common Scenarios

Scenario: SSRF in Web Application Leads to Full Account Compromise

Context: A penetration tester discovers an SSRF vulnerability in a web application hosted on an EC2 instance running IMDSv1. The instance has an IAM role with broad S3 and Lambda permissions.

Approach:

1. Exploit the SSRF to reach http://169.254.169.254/latest/meta-data/iam/security-credentials/<role-name>
2. Extract temporary IAM credentials (AccessKeyId, SecretAccessKey, SessionToken)
3. Use the credentials to enumerate accessible S3 buckets and download sensitive data
4. Check if the role has iam:PassRole + lambda:CreateFunction for privilege escalation to admin
5. Document the full attack chain from SSRF to account-level compromise
6. Recommend: enforce IMDSv2, reduce IAM role scope, add VPC endpoint policies blocking IMDS from application tier

Pitfalls: Not testing IMDSv2 enforcement separately from IMDSv1 gives incomplete results. Failing to clean up test artifacts (backdoor users, Lambda functions) leaves real vulnerabilities after the engagement.

Output Format

Cloud Penetration Test Report
===============================
Target: AWS Account 123456789012 (Production)
Testing Period: 2025-02-24 to 2025-02-28
Methodology: MITRE ATT&CK Cloud + OWASP Cloud Testing Guide
Tester: Security Team - Authorized Engagement

EXECUTIVE SUMMARY:
  Starting with read-only developer credentials, the assessment achieved
  full administrative access to the production account within 3 hours through
  an IAM privilege escalation chain. 47 findings identified across 7 ATT&CK tactics.

CRITICAL FINDINGS:
[PT-001] IAM Privilege Escalation via iam:CreatePolicyVersion
  ATT&CK: T1098.001 (Account Manipulation: Additional Cloud Credentials)
  Severity: CRITICAL
  Starting Point: Developer role with iam:CreatePolicyVersion permission
  Impact: Full administrative access to all account resources
  Evidence: Created policy version granting iam:* and s3:* to test role
  Remediation: Remove iam:CreatePolicyVersion from developer roles, add permission boundary

[PT-002] SSRF to IMDS Credential Theft
  ATT&CK: T1552.005 (Unsecured Credentials: Cloud Instance Metadata API)
  Severity: CRITICAL
  Starting Point: Web application URL parameter vulnerable to SSRF
  Impact: Extracted IAM role credentials with S3 and Lambda access
  Remediation: Enforce IMDSv2, apply WAF rules for SSRF, restrict IAM role scope

FINDING SUMMARY BY MITRE ATT&CK TACTIC:
  Initial Access:       4 findings
  Execution:            3 findings
  Persistence:          6 findings
  Privilege Escalation: 8 findings (3 Critical)
  Defense Evasion:      5 findings
  Credential Access:    7 findings
  Discovery:           14 findings
  Total:               47 findings