Discover key AWS IAM persistence methods, from creating access keys to modifying IAM role policies. These techniques allow adversaries to maintain access and carry out continued operations in a compromised AWS environment. A must-read for security professionals.

New on @hackingthe.cloud! A great post by Federico Lucini on bypassing AWS Network Firewall egress filtering! hackingthe.cloud/aws/post_exp...

AWS Cognito misconfigurations can expose your user pool to unauthorized sign-ups. Attackers can exploit this by finding User Pool Client IDs via web or mobile sources, then using AWS CLI for sign-ups. Ensure ‘Admin Only’ signup settings are enabled to protect your applications.

Managed Identities streamline access between Azure resources. They can, however, be a double-edged sword if poorly configured. Our recent blog explores how misconfigured identities can provide unauthorized access, illustrating potential risks and mitigation strategies. Read more at

Explore how a user can escalate privileges in Google Cloud by leveraging tags used in IAM conditions. Discover how someone with viewer and tagUser roles can gain admin access without changing any policies. Uncover potential risks for unauthorized access and persistent threats.

Explore how to execute commands on AWS EC2 instances with Cloud Security techniques! This guide covers using ssm:SendCommand and ssm:StartSession for remote management and accessing outputs. Perfect for security pros looking to drive insights from AWS environments. Learn more at:

Ever thought of using S3 server access logs for data exfiltration? If you control an IAM identity with `s3:GetObject`, you could receive log details including denied requests alongside the data you aim to exfiltrate. It's a unique take on cloud security worth exploring. Learn more:

Discover how attackers can maintain access in AWS by setting up a rogue OIDC Identity Provider. This complex method can evade detection longer than standard techniques. Learn about configuring the environment to ensure persistence with role policies in AWS. More here:

Unlocking the power of AWS! If you've gained privileged access in an AWS account, learn how to run shell commands on EC2 instances using ssm:SendCommand or Session Manager. These tactics provide ways to execute and interact with environments securely. Dive into the details:

Cloud attackers keep evolving. So should defenses. Enumeration through AWS Resource Explorer used to be invisible. Not anymore. Breakdown from @securitylabs.datadoghq.com: securitylabs.datadoghq.com/articles/enu...

Did you know that GCP IAM Conditions can sometimes do the opposite of what they're meant for? Explore how tags can be exploited for privilege escalation in GCP. A user can achieve admin access without changing any IAM policies. Dive in here:

Discovering your AWS account ID from access keys is a useful skill in cloud security assessments. Use the `sts:GetAccessKeyInfo` API or decode the key itself with Python to find the associated account ID. Understand your scope and ensure compliance seamlessly.

Ever heard of Role Chain Juggling in AWS? By chaining "assume-role" calls, you can maintain longer access without creating new users or keys. Dive into this technique and learn about the AWSRoleJuggler tool by Daniel Heinsen. A must-know for AWS assessments!

Explore how misusing EC2 user data can lead to privilege escalation. If you have `ec2:ModifyInstanceAttribute` permissions, you can execute custom scripts as root on EC2 instances. This involves modifying user data and leveraging cloud-init to execute scripts at boot. Details here:

Maintain access to S3 resources without creating new users by using S3 ACLs to backdoor key objects and buckets in AWS. This method allows read/write access for external accounts, even without public exposure alerts. Dive into how subtle ACL configurations can achieve persistence!

Explore how to connect your EC2 instance to the Tor network without setting off GuardDuty alarms. By utilizing Tor Bridges and obfs4proxy, bypass the UnauthorizedAccess:EC2/TorClient finding seamlessly. Enhance privacy and conceal your traffic's origin. Dive in here:

Discover common vulnerabilities in AWS Lambda that allow attackers to access IAM credentials and event data. These incidents often exploit file read and SSRF vulnerabilities. Learn how attackers can leak sensitive information and how to protect your environments. Read more:

Ever wonder how bad actors can still access AWS after access keys are revoked? They might use sts:GetFederationToken for temporary credentials. Learn how this sneaky trick works and how defenders can combat it by monitoring and controlling the use of this API. More details:

In the event of a compromised AWS account, attackers can manipulate GuardDuty configs to avoid detection. By modifying, not deleting, settings, they can evade alerts without raising suspicion. Key tweaks involve IP lists, CloudWatch rules, and suppression tactics. Read more:

With credentials for IAM roles, it’s crucial to know the Instance Metadata Service's role in security. Learn the differences between IMDSv1 and IMDSv2, and why IMDSv2’s added security layers are a game-changer for protecting your cloud resources.

When improperly secured, AWS's Elastic Container Registry (ECR) can be a vector for attacks. By exploiting ECR permissions, malicious actors can plant backdoors across cloud environments. Tighten IAM controls and secure your CI/CD pipelines to mitigate risks. Learn more:

AMIs in AWS can be public, exposing sensitive data. Discover how to identify and exploit these AMIs by searching for credentials and secrets using AWS commands. Learn manual and automated techniques to dig deeper. Stay informed on cloud security risks! Learn more:

AWS Security Groups can track connections, which could be exploited to maintain connections even after changing Security Group rules. If a connection is active before the rules change, it can persist, posing potential security concerns.

Discover how AWS Organizations' defaults can impact security. Misconfigured roles and default access can lead to organization-wide breaches if not monitored. Learn about potential risks and the importance of securing management accounts. Ensure your defenses are robust. Read more: buff.ly/SKYpm7j

Explore the fascinating ways to enumerate IAM users and roles in another AWS account using no access! Discover methods involving resource-based policies and tools like Quiet Riot for enumeration across AWS, Azure, and Google. Dive into our latest insights today! Link:

Turn AWS Console access into IAM credentials using CloudShell! If you have session cookies from a developer’s browser, you can extract IAM credentials through an undocumented endpoint. Perfect for pen tests where direct credentials aren't available. Dive in for more details.

Discover how to enumerate Google Workspace email addresses with Quiet Riot, potentially aiding password spraying attacks. This could lead to unauthorized access and even help identify AWS Root User accounts. Learn more here:

Explore how to maintain persistence on an EC2 instance using user data scripts. These scripts, often run as root, can be modified to include backdoors, ensuring continued access. Even if you can't change the script, altering resources they access might do the trick. Learn more:

A little over a year ago I published research on how you could leverage non-production AWS API endpoints to enumerate permissions without logging to CloudTrail. A year later...I'm still finding them. Red Teamers, these can be super useful and really up your game!

Ever wondered about Azure's Run Command feature? It's a potent tool for executing scripts, but it can also pose security risks. Our latest post explores how Run Command can be abused for lateral movement within cloud environments, and how to detect such activities. Let's dive in!

Explore how Azure's Blob Storage permissions can lead to anonymous access, allowing data retrieval without authentication. Discover how simple misconfigurations can expose sensitive files. Learn more about security in Azure with practical examples and tips.

Eduard Agavriloae delves into exploiting misconfigured Terraform Cloud OIDC AWS IAM roles. Discover why adding the "app.terraform.io:sub" condition is crucial and learn how these misconfigurations can be exploited—or prevented—using Resource Control Policies. Dive into the details: buff.ly/JJ0VHNV

Unlock the secrets of Lambda persistence with our latest blog! After finding remote code execution vulnerabilities, discover how to establish persistence on AWS Lambda functions using Python and Ruby runtimes. Read more about these techniques and their applications:

Threat actors use the AWS CLI to evade detection and exfiltrate data. By leveraging existing tools on Amazon Linux servers, they avoid common monitoring targets like curl and Wget. This post explores how attackers utilize AWS CLI with S3-compatible backends to move data. Learn more:

Understanding IAM unique identifiers in AWS is crucial for security. Check out the significance of prefixes like 'AKIA' for long-lived keys and 'ASIA' for temporary keys. These play a vital role in managing access securely within your cloud infrastructure.

New on Hacking the Cloud! Did you know that IAM roles can’t be recreated? Even if their ARNs are identical? This can cause a major problem if you delete an IAM role used in SaaS trust relationships 😬 hackingthe.cloud/aws/general-...

🚨 New on Hacking the Cloud: Discover how misconfigured tagBindings.create permissions in GCP can lead to privilege escalation. Learn how attackers can exploit tags to gain elevated access. Stay informed and secure your cloud infrastructure. Read more: hackingthe.cloud/gcp/exploita...

Dive into EC2 User Data! It’s a vital resource for configuring environments but often contains sensitive info like credentials. Learn how attackers can access User Data through internal URLs and APIs, and understand the importance of safeguarding it. More at:

Discover how attackers exploit AWS EC2's Metadata Service to steal IAM credentials via SSRF or XXE vulnerabilities. Ensure your cloud security is airtight by enforcing IMDSv2 across instances to mitigate these risks. Stay informed and protected. Link for deeper insight:

Discover if an email address is tied to an AWS root account by entering it in the AWS Console. A valid email prompts for a password, while an invalid one shows an error message. Simple yet effective to check account ownership! Find out more:

AWS Amplify's vulnerability CVE-2024-28056 involves IAM roles susceptible to same-account exploitation due to misconfigured policies. Despite AWS's partial fix, a potential breach could occur if a basic authflow identity pool is misconfigured. Learn how to protect your resources.

Got shell access to an AWS EC2 instance? You can find the account ID with aws sts get-caller-identity or by querying instance metadata. Handy for audits, investigations, or just understanding your environment. Details + commands here:

@hackingthe.cloud has crossed the 2,000 stargazers mark on GitHub! Thank you so much to everyone who has supported and contributed to the project over the years. I have much more content on the way!

Ever thought of using S3 server access logs for data exfiltration? If you can make GetObject requests, even denied ones, you might be able to leak data into a logging bucket you control. It's sneaky, but it has its challenges. Full breakdown here:

Once an attacker gains access to AWS, they’ll want to stick around. This blog explores IAM persistence techniques—like abusing access keys, login profiles, and role policies—to maintain control. Defenders, take notes. Read more:

Managed Identities in Azure make access management easy, but misconfigurations can be a goldmine for attackers. By abusing a web app’s identity, an attacker can escalate privileges, retrieve storage keys, and access sensitive data. Learn how it works:

Misconfigured IAM role trust policies with wildcard principals can let any AWS account assume your roles—even outside your org. This mistake is easier to make than you’d think, and harder to catch than you'd hope. Here’s how attackers exploit it and how to avoid it:

GCP instance metadata can be a goldmine for attackers—exposing project IDs, service accounts, and even access tokens. A simple cURL request to metadata.google.internal can reveal sensitive info. If you're in cloud security, you need to understand these risks. Learn more: buff.ly/4i24H7N

Got AWS creds but want to ID the principal without setting off alarms? Instead of get-caller-identity, try triggering errors in certain AWS services. sqs:ListQueues can return the calling role & account ID—without logging to CloudTrail. Details here:

AWS GuardDuty flags Kali, ParrotOS, and Pentoo Linux when making API requests. But did you know you can modify your AWS CLI User-Agent string to avoid these alerts? A simple Burp Suite setup can keep your activity under the radar. Here’s how to do it: