Cloud & AWS Security
AWS misconfigurations are the #1 attack vector we find in product security assessments. These deep dives cover IAM, EC2, Lambda, App Runner, and cloud-native attack paths.
Backdooring AMIs for Fun and Profit
A walkthrough of how a malicious public AMI can embed a reverse shell backdoor that calls home when a victim launches an EC2 instance from it, giving attackers access to the victim's instance role.
Exploiting IAM security Misconfigurations — Part 2
Part 2 of the IAM misconfiguration series: exploiting overly permissive CreatePolicyVersion permissions to escalate privileges and gain access to sensitive AWS resources like S3.
Getting shell and data access in AWS App Runner
What happens when an attacker gains remote code execution in an AWS App Runner container — a research walkthrough of pivoting from RCE to stealing secrets from AWS Secrets Manager.
Exploiting IAM security Misconfigurations — Part 1
How attackers exploit AWS IAM misconfigurations — starting with a misconfigured AssumeRole policy — to perform privilege escalation and move laterally through cloud environments.
Finding Treasures in Github and Exploiting AWS for Fun and Profit — Part 1
A bug bounty story of using GitHub dorks to find exposed AWS credentials in public repositories, then exploiting them to gain root access to an EC2 instance.
Hacking AWS Lambda for security, fun and profit
An introduction to AWS Lambda security vulnerabilities — insecure code, over-permissive roles, and serverless-specific attack vectors — explored hands-on using the ServerlessGoat vulnerable app.
Hacker Days: Understanding AWS cloud attacks using CloudGoat — OWASP Bay Area
Slides, video, and Q&A from an OWASP Bay Area webinar demonstrating real AWS attack scenarios — privilege escalation, SSRF, and IAM abuse — using CloudGoat.
Exploiting weak configurations in Amazon Cognito in AWS
How to detect and exploit misconfigured Amazon Cognito identity pools, covering federated identity abuse and techniques found during real web and mobile application assessments.
Server Side Request Forgery via HTML injection in PDF download
A real-world pentest story of chaining unsanitised user input in a PDF download feature into a full SSRF on AWS, with a walkthrough of each discovery and escalation step.
Finding SSRF via HTML Injection inside a PDF file on AWS EC2
How a stored HTML injection vulnerability in a PDF generation feature was escalated to a full SSRF on AWS EC2, enabling access to instance metadata and temporary IAM credentials.
AWS EC2 IMDSv2 versus an esoteric HTTP Method
An investigation into whether the X-HTTP-Method-Override header can be used to bypass IMDSv2 on AWS EC2 instances — and why the answer is definitively no.
Automating Migration to Version 2 of AWS EC2 Instance Metadata Service (IMDSv2) in Scale
How to automate bulk migration of EC2 instances from IMDSv1 to IMDSv2 across multiple AWS regions using Ansible playbooks.
Server Side Request Forgery (SSRF) and AWS EC2 instances after Instance Meta Data Service version…
How IMDSv2's token-based authentication changes the impact of SSRF on AWS EC2 instances, and what attackers can and cannot do against the new endpoint protection.
Getting started with Version 2 of AWS EC2 Instance Metadata service (IMDSv2)
A practical guide to AWS EC2 Instance Metadata Service v2 (IMDSv2): how it works, how to enable it, monitor adoption via CloudWatch, and roll back if needed.