Test lab

AWS tools

Preparation

Reconnaissance
Enumeration

Notes on techniques

Introduction
- What?
- Why?
- How?
Challenges and problems
Account and privilege attacks
Cloud-centric attacks
Abusing misconfigurations
Hacking CI/CD pipelines

IAM

Introduction
- What?
- Why?
- How?
IAM enumeration
Misconfigured trust policy
Overly permissive permission I
Dangerous policy combination I
Dangerous policy combination II
Overly permissive permission II
Pass Role: EC2
Pass Role: Lambda
Pass Role: CloudFormation

API Gateway

Introduction
- What?
- Why?
- How?
API gateway enumeration
Verb tampering
Misconfigured private API
IAM based authentication
Denial of service
Poor Lambda authoriser

More

Bust-a-Kube
flAWS 2
AWSGoat
CloudGoat

Head in the clouds

Ty Myrddin Home
Unseen University
Improbability Blog
About
Contact

API gateway enumeration

Objective: Using the access credentials, enumerate the API Gateways present on the AWS account.

Previous Next

Unseen University, 2024, with a forest garden fostered by /ut7.