Head in the clouds

Virtualisation technology in the cloud has become a huge resource to leverage, as it promises high availability and access to resources from anywhere. From individuals, enterprises to large conglomerates, nearly everyone is migrating towards the cloud. With this come often unseen threats because cloud environments are different from the traditional infrastructure.

---

Test lab

• AWS tools

---

Preparation

• Reconnaissance
• Enumeration

---

Notes on techniques

• Introduction
• Challenges and problems
• Account and privilege attacks
• Cloud-centric attacks
• Abusing misconfigurations
• Hacking CI/CD pipelines

---

Attacking and defending AWS

With millions of active customers, Amazon Web Services (AWS) is one of the most popular cloud service providers, hence also of importance to hackers. Gaining access to one such corporate AWS account can cost a company billions of dollars, and users their privacy and perhaps even their identity.

IAM

• Introduction
• IAM enumeration
• Misconfigured trust policy
• Overly permissive permission I
• Dangerous policy combination I
• Dangerous policy combination II
• Overly permissive permission II
• Pass Role: EC2
• Pass Role: Lambda
• Pass Role: CloudFormation

API Gateway

• Introduction
• API gateway enumeration
• Verb tampering
• Misconfigured private API
• IAM based authentication
• Denial of service
• Poor Lambda authoriser

---

More

• Bust-a-Kube
• flAWS 2
• AWSGoat
• CloudGoat

---