# Security Research & Insights

Technical deep dives from the team that tests products for a living.

## Cloud & AWS Security

AWS misconfigurations are the #1 attack vector we find in product security assessments. These deep dives cover IAM, EC2, Lambda, App Runner, and cloud-native attack paths.

### [Exploiting IAM security Misconfigurations — Part 2](/content/blog/exploiting-iam-security-misconfigurations-part-2/index.html)
Part 2 of the IAM misconfiguration series: exploiting overly permissive CreatePolicyVersion permissions to escalate privileges and gain access to sensitive AWS resources like S3.

### [Getting shell and data access in AWS App Runner](/content/blog/getting-shell-and-data-access-in-aws-app-runner/index.html)
What happens when an attacker gains remote code execution in an AWS App Runner container — a research walkthrough of pivoting from RCE to stealing secrets from AWS Secrets Manager.

### [Exploiting IAM security Misconfigurations — Part 1](/content/blog/exploiting-iam-security-misconfigurations-part-1/index.html)
How attackers exploit AWS IAM misconfigurations — starting with a misconfigured AssumeRole policy — to perform privilege escalation and move laterally through cloud environments.

## Kubernetes Security

Container orchestration expands the attack surface. We test K8s clusters the way real attackers approach them — from RBAC to pod escapes.

### [A Pentester’s Approach to Kubernetes Security — Part 2](/content/blog/a-pentester-s-approach-to-kubernetes-security-part-2/index.html)
Part 2 of Appsecco's Kubernetes pentest series, focusing on overprivileged RBAC, cloud IAM to Kubernetes mappings, and how attackers escape from cluster to cloud.

### [A Pentester’s Approach to Kubernetes Security — Part 1](/content/blog/a-pentester-s-approach-to-kubernetes-security-part-1/index.html)
A practical rundown of the most common Kubernetes misconfigurations found during real pentests, covering network policy gaps, exposed API proxies, and service account privilege issues.

### [Hacking an AWS hosted Kubernetes backed product, and failing](/content/blog/hacking-an-aws-hosted-kubernetes-backed-product-and-failing/index.html)
A transparent pentest post-mortem: how Appsecco attacked a well-architected AWS EKS product, what attack paths were tried, and which security design decisions stopped them cold.

## Vulnerability Analysis

When critical vulnerabilities emerge, we break them down with technical depth — what happened, how it was exploited, and what you should do about it.

### [Security Guidance for the Apache Log4j vulnerability (CVE-2021–44228)](/content/blog/security-guidance-for-the-apache-log4j-vulnerability-cve-202/index.html)
Security guidance on the critical Apache Log4j JNDI injection vulnerability (CVE-2021-44228), covering how the exploit works, affected versions, and steps to detect and remediate it.

### [Zerologon (CVE-2020–1472) detection, patching and monitoring](/content/blog/zerologon-cve-2020-1472-detection-patching-and-monitoring/index.html)
A technical overview of Zerologon (CVE-2020-1472), the CVSS 10 Windows Netlogon flaw that gives unauthenticated attackers domain admin — with detection, exploitation, patching, and monitoring guidance.

### [Security Analysis of LastPass credential leak — By bypassing do_popupregister()](/content/blog/security-analysis-of-lastpass-credential-leak-by-bypassing-d/index.html)
A technical analysis of the LastPass browser extension credential leak discovered by Google Project Zero: how the do_popupregister() bypass works and what it exposes.

## Docker & Container Security

Containers are only as secure as their configuration. Hardening guides and attack techniques for Docker and container runtimes.

### [Top 10 Docker Hardening Best Practices](/content/blog/top-10-docker-hardening-best-practices/index.html)
Ten actionable Docker security practices — from keeping the host kernel patched to using AppArmor and dropping capabilities — to reduce the attack surface of containerised workloads.

## Identity & Authentication

Broken authentication is consistently in the OWASP Top 10. We cover identity platforms, session management, and auth bypass techniques — including Cognito and Google Identity Platform.

### [Exploiting weak configurations in Google Identity Platform](/content/blog/exploiting-weak-configurations-in-google-identity-platform/index.html)
How misconfigured Google Cloud Identity Platform (Firebase) applications can leak API keys and auth tokens, allowing unauthenticated users to query, modify, or delete backend identity data.

## AppSec Engineering

Security architecture, authorization patterns, and engineering practices that make products harder to break.

### [How was Uber hacked, and what can we learn from the incident?](/content/blog/how-was-uber-hacked-and-what-can-we-learn-from-the-incident/index.html)
A technical breakdown of the 2022 Uber breach: how dark web credentials, MFA fatigue attacks, and lateral movement through internal tooling led to full corporate access.

### [Hacking apps using NoSQL Injection](/content/blog/hacking-apps-using-nosql-injection/index.html)
Hacking apps using NoSQL Injection.

### [Microservices Authorization using Open Policy Agent and Traefik (API Gateway)](/content/blog/microservices-authorization-using-open-policy-agent-and-trae/index.html)
Microservices Authorization using Open Policy Agent and Traefik (API Gateway).

> Ready to go deeper?
> 
> Every post we publish comes from real work with real products. Let us apply the same thinking to yours.