Ever wonder how attackers discover valid Google Workspace emails without authentication? Learn about this technique using Quiet Riot and the potential implications for password spraying attacks and AWS Root User testing. Understanding these tactics is crucial for cloud security.

Explore unique GCP security strategies with us! Learn about project hierarchies and how policy constraints can enhance security but remember, most aren't retroactive. Dive into scenarios and constraints that shape your cloud environment securely. More insights here:

ver worried about detection when using AWS CLI from specific Linux distros? Modify the User-Agent string to bypass GuardDuty alerts. Our blog dives into using Burp Suite for this, ensuring you leave no suspicious trails. Take control of what your requests reveal. Read more: buff.ly/ycJiEvz

Exploring Lambda persistence? Our latest blog reveals how to establish persistence on AWS Lambda after gaining remote code execution using Python and Ruby runtimes as examples. Learn how to backdoor runtime files effectively while keeping things "warm." Check it out here:

Deleting compromised AWS IAM keys might not be enough! Attackers can use `sts:GetFederationToken` to create temporary access credentials. Explore this technique and learn defensive measures like monitoring and using a "DenyAll" policy. Stay one step ahead. Read more:

Learn the risks of AWS Elastic Container Registry (ECR) misuse. An attacker could use ECR permissions to implant backdoors in containers, gaining control over systems. Understand how this is done and adopt security measures like least privilege access and Docker image signing.

Curious about cybersecurity tactics? Discover how ANSI escape sequences can hide malicious Terraform code from unsuspecting devs. Learn more about this sneaky technique and how it can obfuscate terminal output during Terraform apply operations. Check out the full blog post here:

AWS EC2 instances can be vulnerable to persistence via user data scripts. If someone gains access, modifying these scripts or resources they call can backdoor your instance. Learn how to secure your cloud with insights on script modification techniques. Follow the full post here:

Threat actors exploit the AWS CLI to discreetly download tools and exfiltrate data by blending into AWS environments where it's often pre-installed. This method, seen in attacks like SCARLETEEL, utilizes non-standard endpoints for covert actions. Enhance security awareness! Link:

Dive into the power—and risk—of metadata in Google Cloud instances. Users and potential attackers alike can glean critical instance information through HTTP requests to specific endpoints. It’s essential to understand what data can be accessed and how to secure it. Learn more:

GuardDuty configurations can be subtly altered by attackers to avoid detection after compromising an account. Modifying detectors, IP lists, Cloudwatch rules, suppression filters, and alert destinations can reduce alerting efficacy. Learn more:

Discover key AWS IAM persistence methods, from creating access keys to modifying IAM role policies. These techniques allow adversaries to maintain access and carry out continued operations in a compromised AWS environment. A must-read for security professionals.

New on @hackingthe.cloud! A great post by Federico Lucini on bypassing AWS Network Firewall egress filtering! hackingthe.cloud/aws/post_exp...

AWS Cognito misconfigurations can expose your user pool to unauthorized sign-ups. Attackers can exploit this by finding User Pool Client IDs via web or mobile sources, then using AWS CLI for sign-ups. Ensure ‘Admin Only’ signup settings are enabled to protect your applications.

Managed Identities streamline access between Azure resources. They can, however, be a double-edged sword if poorly configured. Our recent blog explores how misconfigured identities can provide unauthorized access, illustrating potential risks and mitigation strategies. Read more at

Explore how a user can escalate privileges in Google Cloud by leveraging tags used in IAM conditions. Discover how someone with viewer and tagUser roles can gain admin access without changing any policies. Uncover potential risks for unauthorized access and persistent threats.

Explore how to execute commands on AWS EC2 instances with Cloud Security techniques! This guide covers using ssm:SendCommand and ssm:StartSession for remote management and accessing outputs. Perfect for security pros looking to drive insights from AWS environments. Learn more at:

Ever thought of using S3 server access logs for data exfiltration? If you control an IAM identity with `s3:GetObject`, you could receive log details including denied requests alongside the data you aim to exfiltrate. It's a unique take on cloud security worth exploring. Learn more:

Discover how attackers can maintain access in AWS by setting up a rogue OIDC Identity Provider. This complex method can evade detection longer than standard techniques. Learn about configuring the environment to ensure persistence with role policies in AWS. More here:

Unlocking the power of AWS! If you've gained privileged access in an AWS account, learn how to run shell commands on EC2 instances using ssm:SendCommand or Session Manager. These tactics provide ways to execute and interact with environments securely. Dive into the details:

Cloud attackers keep evolving. So should defenses. Enumeration through AWS Resource Explorer used to be invisible. Not anymore. Breakdown from @securitylabs.datadoghq.com: securitylabs.datadoghq.com/articles/enu...

Did you know that GCP IAM Conditions can sometimes do the opposite of what they're meant for? Explore how tags can be exploited for privilege escalation in GCP. A user can achieve admin access without changing any IAM policies. Dive in here:

Discovering your AWS account ID from access keys is a useful skill in cloud security assessments. Use the `sts:GetAccessKeyInfo` API or decode the key itself with Python to find the associated account ID. Understand your scope and ensure compliance seamlessly.

Ever heard of Role Chain Juggling in AWS? By chaining "assume-role" calls, you can maintain longer access without creating new users or keys. Dive into this technique and learn about the AWSRoleJuggler tool by Daniel Heinsen. A must-know for AWS assessments!

Explore how misusing EC2 user data can lead to privilege escalation. If you have `ec2:ModifyInstanceAttribute` permissions, you can execute custom scripts as root on EC2 instances. This involves modifying user data and leveraging cloud-init to execute scripts at boot. Details here:

Maintain access to S3 resources without creating new users by using S3 ACLs to backdoor key objects and buckets in AWS. This method allows read/write access for external accounts, even without public exposure alerts. Dive into how subtle ACL configurations can achieve persistence!

Explore how to connect your EC2 instance to the Tor network without setting off GuardDuty alarms. By utilizing Tor Bridges and obfs4proxy, bypass the UnauthorizedAccess:EC2/TorClient finding seamlessly. Enhance privacy and conceal your traffic's origin. Dive in here:

Discover common vulnerabilities in AWS Lambda that allow attackers to access IAM credentials and event data. These incidents often exploit file read and SSRF vulnerabilities. Learn how attackers can leak sensitive information and how to protect your environments. Read more:

Ever wonder how bad actors can still access AWS after access keys are revoked? They might use sts:GetFederationToken for temporary credentials. Learn how this sneaky trick works and how defenders can combat it by monitoring and controlling the use of this API. More details:

In the event of a compromised AWS account, attackers can manipulate GuardDuty configs to avoid detection. By modifying, not deleting, settings, they can evade alerts without raising suspicion. Key tweaks involve IP lists, CloudWatch rules, and suppression tactics. Read more:

With credentials for IAM roles, it’s crucial to know the Instance Metadata Service's role in security. Learn the differences between IMDSv1 and IMDSv2, and why IMDSv2’s added security layers are a game-changer for protecting your cloud resources.

When improperly secured, AWS's Elastic Container Registry (ECR) can be a vector for attacks. By exploiting ECR permissions, malicious actors can plant backdoors across cloud environments. Tighten IAM controls and secure your CI/CD pipelines to mitigate risks. Learn more:

AMIs in AWS can be public, exposing sensitive data. Discover how to identify and exploit these AMIs by searching for credentials and secrets using AWS commands. Learn manual and automated techniques to dig deeper. Stay informed on cloud security risks! Learn more:

AWS Security Groups can track connections, which could be exploited to maintain connections even after changing Security Group rules. If a connection is active before the rules change, it can persist, posing potential security concerns.

Discover how AWS Organizations' defaults can impact security. Misconfigured roles and default access can lead to organization-wide breaches if not monitored. Learn about potential risks and the importance of securing management accounts. Ensure your defenses are robust. Read more: buff.ly/SKYpm7j

Explore the fascinating ways to enumerate IAM users and roles in another AWS account using no access! Discover methods involving resource-based policies and tools like Quiet Riot for enumeration across AWS, Azure, and Google. Dive into our latest insights today! Link:

Turn AWS Console access into IAM credentials using CloudShell! If you have session cookies from a developer’s browser, you can extract IAM credentials through an undocumented endpoint. Perfect for pen tests where direct credentials aren't available. Dive in for more details.

Discover how to enumerate Google Workspace email addresses with Quiet Riot, potentially aiding password spraying attacks. This could lead to unauthorized access and even help identify AWS Root User accounts. Learn more here:

Explore how to maintain persistence on an EC2 instance using user data scripts. These scripts, often run as root, can be modified to include backdoors, ensuring continued access. Even if you can't change the script, altering resources they access might do the trick. Learn more:

A little over a year ago I published research on how you could leverage non-production AWS API endpoints to enumerate permissions without logging to CloudTrail. A year later...I'm still finding them. Red Teamers, these can be super useful and really up your game!

Ever wondered about Azure's Run Command feature? It's a potent tool for executing scripts, but it can also pose security risks. Our latest post explores how Run Command can be abused for lateral movement within cloud environments, and how to detect such activities. Let's dive in!

Explore how Azure's Blob Storage permissions can lead to anonymous access, allowing data retrieval without authentication. Discover how simple misconfigurations can expose sensitive files. Learn more about security in Azure with practical examples and tips.

Eduard Agavriloae delves into exploiting misconfigured Terraform Cloud OIDC AWS IAM roles. Discover why adding the "app.terraform.io:sub" condition is crucial and learn how these misconfigurations can be exploited—or prevented—using Resource Control Policies. Dive into the details: buff.ly/JJ0VHNV

Unlock the secrets of Lambda persistence with our latest blog! After finding remote code execution vulnerabilities, discover how to establish persistence on AWS Lambda functions using Python and Ruby runtimes. Read more about these techniques and their applications:

Threat actors use the AWS CLI to evade detection and exfiltrate data. By leveraging existing tools on Amazon Linux servers, they avoid common monitoring targets like curl and Wget. This post explores how attackers utilize AWS CLI with S3-compatible backends to move data. Learn more:

Understanding IAM unique identifiers in AWS is crucial for security. Check out the significance of prefixes like 'AKIA' for long-lived keys and 'ASIA' for temporary keys. These play a vital role in managing access securely within your cloud infrastructure.

New on Hacking the Cloud! Did you know that IAM roles can’t be recreated? Even if their ARNs are identical? This can cause a major problem if you delete an IAM role used in SaaS trust relationships 😬 hackingthe.cloud/aws/general-...

🚨 New on Hacking the Cloud: Discover how misconfigured tagBindings.create permissions in GCP can lead to privilege escalation. Learn how attackers can exploit tags to gain elevated access. Stay informed and secure your cloud infrastructure. Read more: hackingthe.cloud/gcp/exploita...

Dive into EC2 User Data! It’s a vital resource for configuring environments but often contains sensitive info like credentials. Learn how attackers can access User Data through internal URLs and APIs, and understand the importance of safeguarding it. More at:

Discover how attackers exploit AWS EC2's Metadata Service to steal IAM credentials via SSRF or XXE vulnerabilities. Ensure your cloud security is airtight by enforcing IMDSv2 across instances to mitigate these risks. Stay informed and protected. Link for deeper insight: