# Cloud & AWS Security

AWS misconfigurations are the #1 attack vector we find in product security assessments. These deep dives cover IAM, EC2, Lambda, App Runner, and cloud-native attack paths.

### [Backdooring AMIs for Fun and Profit](/content/blog/backdooring-amis-for-fun-and-profit/index.html)
A walkthrough of how a malicious public AMI can embed a reverse shell backdoor that calls home when a victim launches an EC2 instance from it, giving attackers access to the victim's instance role.

### [Exploiting IAM security Misconfigurations — Part 2](/content/blog/exploiting-iam-security-misconfigurations-part-2/index.html)
Part 2 of the IAM misconfiguration series: exploiting overly permissive CreatePolicyVersion permissions to escalate privileges and gain access to sensitive AWS resources like S3.

### [Getting shell and data access in AWS App Runner](/content/blog/getting-shell-and-data-access-in-aws-app-runner/index.html)
What happens when an attacker gains remote code execution in an AWS App Runner container — a research walkthrough of pivoting from RCE to stealing secrets from AWS Secrets Manager.

### [Exploiting IAM security Misconfigurations — Part 1](/content/blog/exploiting-iam-security-misconfigurations-part-1/index.html)
How attackers exploit AWS IAM misconfigurations — starting with a misconfigured AssumeRole policy — to perform privilege escalation and move laterally through cloud environments.

### [Finding Treasures in Github and Exploiting AWS for Fun and Profit — Part 1](/content/blog/finding-treasures-in-github-and-exploiting-aws-for-fun-and-p/index.html)
A bug bounty story of using GitHub dorks to find exposed AWS credentials in public repositories, then exploiting them to gain root access to an EC2 instance.

### [Hacking AWS Lambda for security, fun and profit](/content/blog/hacking-aws-lambda-for-security-fun-and-profit/index.html)
An introduction to AWS Lambda security vulnerabilities — insecure code, over-permissive roles, and serverless-specific attack vectors — explored hands-on using the ServerlessGoat vulnerable app.

### [Hacker Days: Understanding AWS cloud attacks using CloudGoat — OWASP Bay Area](/content/blog/hacker-days-understanding-aws-cloud-attacks-using-cloudgoat-/index.html)
Slides, video, and Q&A from an OWASP Bay Area webinar demonstrating real AWS attack scenarios — privilege escalation, SSRF, and IAM abuse — using CloudGoat.

### [Exploiting weak configurations in Amazon Cognito in AWS](/content/blog/exploiting-weak-configurations-in-amazon-cognito-in-aws/index.html)
How to detect and exploit misconfigured Amazon Cognito identity pools, covering federated identity abuse and techniques found during real web and mobile application assessments.

### [Server Side Request Forgery via HTML injection in PDF download](/content/blog/server-side-request-forgery-via-html-injection-in-pdf-downlo/index.html)
A real-world pentest story of chaining unsanitised user input in a PDF download feature into a full SSRF on AWS, with a walkthrough of each discovery and escalation step.

### [Finding SSRF via HTML Injection inside a PDF file on AWS EC2](/content/blog/finding-ssrf-via-html-injection-inside-a-pdf-file-on-aws-ec2/index.html)
How a stored HTML injection vulnerability in a PDF generation feature was escalated to a full SSRF on AWS EC2, enabling access to instance metadata and temporary IAM credentials.

### [AWS EC2 IMDSv2 versus an esoteric HTTP Method](/content/blog/aws-ec2-imdsv2-versus-an-esoteric-http-method/index.html)
An investigation into whether the X-HTTP-Method-Override header can be used to bypass IMDSv2 on AWS EC2 instances — and why the answer is definitively no.

### [Automating Migration to Version 2 of AWS EC2 Instance Metadata Service (IMDSv2) in Scale](/content/blog/automating-migration-to-version-2-of-aws-ec2-instance-metada/index.html)
How to automate bulk migration of EC2 instances from IMDSv1 to IMDSv2 across multiple AWS regions using Ansible playbooks.

### [Server Side Request Forgery (SSRF) and AWS EC2 instances after Instance Meta Data Service version…](/content/blog/server-side-request-forgery-ssrf-and-aws-ec2-instances-after/index.html)
How IMDSv2's token-based authentication changes the impact of SSRF on AWS EC2 instances, and what attackers can and cannot do against the new endpoint protection.

### [Getting started with Version 2 of AWS EC2 Instance Metadata service (IMDSv2)](/content/blog/getting-started-with-version-2-of-aws-ec2-instance-metadata-/index.html)
A practical guide to AWS EC2 Instance Metadata Service v2 (IMDSv2): how it works, how to enable it, monitor adoption via CloudWatch, and roll back if needed.