Hacking Cloud Services

Question 1

Cloud Vulnerability Scanners

Answer 1

trivy
clair
dagda
twistlock
sysdig

Question 2

Define S3

Answer 2

AWS Simple Storage Service

Question 3

S3 Enumeration

Answer 3

Check source code

Scanners (bucketkicker, S3Scanner, S3Inspector)

Question 4

AWS Enumerations

Answer 4

Account IDs
Social Media Posting
Roles
Keys/Credentials
Password Reuse
Hosted Vulnerable Apps
IM Role Misconfigurations

Question 5

AWS Pentesting Tools

Answer 5

PACU
CloudGoat 2
AWS_pwn

Question 6

AWS IAM Privilege Escalation Techniques

Answer 6

Create EC2 Instance with Existing Profile
Custom Permissions
Add yourself to new group