Penetration Testing and Red Teaming on AWS

Explore how virtualization enables scalable cloud on demand, review various cloud services and deployment models, and clarify the shared security responsibility between cloud providers and customers.

Explore how virtualization underpins cloud computing by enabling multiple virtual machines, virtual storage, and virtual networks, supporting scalable infrastructure as a service and platform as a service.

Explore cloud computing's key characteristics, including on-demand provisioning, multi-tenant sharing, and elastic scaling. See how pay-as-you-go billing, virtualization, and public, private, hybrid, or multi-cloud deployment enable secure, accessible resources.

Explain the three main cloud service models—IaaS, PaaS, and SaaS—clarifying customer control, vendor responsibilities, and examples like Google Docs and Office 365.

Explore the four cloud deployment models: private, public, community, and hybrid—and how vendors like AWS, Azure, and Google manage resources, compliance, and data across on-premises and third-party infrastructures.

Learn how the shared responsibility model assigns cloud security duties to customers based on service type, from EC2's guest OS management to SaaS data protection.

Explore the AWS cloud and the future of its services, building on cloud fundamentals to show how AWS fulfills core cloud capabilities.

Learn how cloud computing delivers on-demand technology services over the internet with a pay-as-you-go model, and how AWS provides over 200 services from data centres globally.

Explore how AWS regions group data centers into availability zones, each with independent power, cooling, and security. Design applications across multiple zones to improve fault tolerance and high availability.

Explore AWS services spanning compute, storage, databases, analytics, network, IoT, and security to develop, deploy, and operate applications with on-demand, pay-as-you-go pricing worldwide.

Explore aws computing services like ec2 on demand, spot, and reserved; leverage lambda and autoscaling to meet demand, and deploy containerized apps with Amazon elastic container service.

Explore AWS storage services categorized into block, file, and object storage, detailing high-performance block storage for databases, centralized file storage with locking, and scalable object storage for unstructured data.

CloudFront, a fast content delivery network, caches content at edge locations globally for low latency and integrates with S3, EC2, and Lambda, with HTTPS encryption and access control.

Translate domain names to IP addresses and route traffic by geography, latency, and weighted routing with Route 53. Register domains, manage dns records, and monitor health to keep applications available.

Explore core security services to identify assets and compliance requirements, protect infrastructure and data, detect threats and vulnerabilities, and monitor security effectiveness.

Define per-user permissions in AWS Identity and Access Management to secure resources. Enable multi-factor authentication and federated access from existing identity systems, including directory services and single sign-on.

Explore how AWS infrastructure security provides privacy and control over network access through VPC firewalls, private connectivity, and TLS-encrypted traffic across AWS services.

Explore inventory and configuration management tools and deployment pipelines that create, monitor, and decommission resources according to organization standards, track changes, and deploy standard, hardened EC2 templates on AWS.

Explore data at rest encryption options across AWS services like EBS, S3, ElastiCache, Lambda, and SageMaker. Learn flexible key management with KMS, customer managed keys, CloudHSM, and SQS encryption.

Explore how AWS logs and monitoring services, including AWS CloudTrail, Amazon CloudWatch, and Amazon GuardDuty, track API calls, user activity, source IP, and detect malicious behavior in your environment.

Explain how the shared responsibility model divides security duties between cloud providers and cloud users to protect cloud environments.

Explain the shared responsibility for cloud security, covering infrastructure, hardware, software, and facilities you run, and how AWS secures its services such as S3 and EC2.

Learn how the shared responsibility model divides security between cloud infrastructure and the customer, who must configure firewalls, encryption, IAM, network security, and credential management to protect data and applications.

Explain the purpose of penetration testing and its importance, and identify AWS attack surfaces and practical methods to discover them.

Penetration testing identifies vulnerabilities and tests the effectiveness of security controls, helping organizations prioritize investments, mitigate cyber risk, and understand potential attack impact, while meeting regulatory requirements.

Identify the target environment for black box, grey box, or red team activities, gather basic information, and rely on read-only access via API with key and secret.

Identify system requirements for penetration testing and red teaming on AWS. Recommend Kali Linux or Linux with Nmap and Metasploit, using Python and Go CLI tools, with tool-by-tool explanations.

Create and manage aws access keys from the security credentials area in the aws console, avoid using the root user account, and download the access key as a csv file.

Install and configure the AWS CLI to interact with your AWS environment, download the zip file, and configure access key ID, secret key, region name, and default output format.

Configure multiple AWS accounts or users by creating named profiles in the AWS credential file, then run commands through a chosen profile or export profiles as needed to control access.

Identify cloud attack surfaces, including network gateways and virtual private cloud, web application APIs and serverless functions, storage with databases and object or block storage, and IAM roles and permissions.

Explore external, configuration review, and internal network testing of AWS environments using black box and gray box methods with automated tools to spot misconfigurations.

Perform an assessment of AWS environments by identifying publicly accessible resources such as web apps, EC2, databases, and S3 buckets, using black box and gray box methods to uncover vulnerabilities.

Identify internet facing resources and publicly accessible instances with osint tools like Shodan and Census, and audit cloud resources using Cloud Venom, Cloud Mapper, and cli.

Explore how to use Shodan and Google Dorks to locate internet-connected devices and exposed services by keyword, IP address, or domain, enabling OSINT for AWS pentesting.

Explore certstream, a real-time osint stream of ssl tls certificates. Analyze domains and aws related strings from common name or subject alternative name fields, drawn from certificate transparency logs.

Use Netcraft to retrieve public domain information via the DNS search option, including IP addresses, nameservers, reverse DNS, owner, domain registry, and regions.

Explore how AWS publishes current IP address ranges in a public JSON file, covering EC2, databases, and other services across regions, with regular updates reflecting changes.

Use a Python module from AWS to check if an IP or network lies in AWS IP ranges, identify the prefix and services (S3), and filter by region.

Learn recon with osint tools to locate open S3 buckets in AWS environments, using bucket stream and bucket dumps to identify target organization buckets for penetration testing.

S3 now blocks public access and disables access control lists for all new buckets, with four bucket-level settings blocked and public access policies rejected to prevent exposure.

Enumerate Amazon S3 buckets using bucket dump and word lists. Find open S3 buckets with bucket stream, certificate transparency logs, and Google Docs searches.

Enumerate public IPs and external endpoints on AWS using the CLI, security groups, and tools like Cloud Fox and Get Target, with Python boto for region-wide testing.

Explore the core IAM components in AWS, including users, groups, roles, and policies, and learn how temporary credentials and policy attachments control access to resources.

Understand key IAM terms in AWS, including users, roles, and applications, and how authentication, policy-based authorization, and requests govern actions on resources.

Create an IAM user with console access, configure password, assign to groups, attach or copy permissions, enable MFA, and define inline or managed policies for an S3 demo bucket.

Define and attach identity and access management policies that specify actions, resources, and effects to users, roles, groups, or services like s3 and sqs, with default deny.

Create a policy to allow listing an S3 bucket and attach it to a user, enabling the demo user to perform only the list bucket action.

Manage AWS policies with versioning, keeping up to five versions and setting a default (latest by default), then switch versions via CLI or the management console to explore elevated permission.

Learn how to craft json policies for aws iam, analyze wildcard actions, and detect misconfigurations that create broad access or loopholes.

Learn how AWS IAM trust policies define which accounts, users, roles, or services can assume roles, granting temporary permissions and enforcing least privilege to prevent unauthorized access.

Learn how least privilege access defines granular permissions as the smallest unit of permission for AWS resources, enabling specific read access to S3 buckets while restricting delete or modify rights.

Explore resource-based policies with multiple statements that grant a demo user get bucket location and get objects permissions to download files from any directory in the techeetah demo bucket.

Attach multiple policies to an entity to grant permissions, or combine them into one policy; statements apply a logical or across evaluations, with conditions like MFA or region.

Create the IAM demo user one, attach the security audit AWS managed policy, verify the user and profile with get user, then detach the policy and confirm no policies remain.

Demonstrates creating a policy with multiple versions, updating versions to include get and list permissions, and attaching the latest policy version to the IAM demo user.

Explore how the AWS Escalate Python script enumerates AWS users and outputs a CSV mapping their permissions and attached policies.

Identify AWS IAM attack surface by using cloudfox to enumerate permissions and principals, generate CSV and text outputs, and map policies, actions, and resources for users and roles.

Identify how an attacker can escalate from same-level access to administrative access by abusing AWS policies like IAM PassRole, create access key, and CloudFormation stack creation.

Explore privilege escalation scenarios on AWS, from IAM PassRole and EC2 access to creating keys, login profiles, and attaching policies, including Lambda, CloudFormation, and Data Pipeline permissions.

An IAM user with limited privileges escalates to full admin by attaching a privileged role to an instance profile, then launches an EC2 instance and terminates target using AWS CLI.

Demonstrates privilege escalation on AWS by swapping instance profile roles from meek to mighty, granting full administrative access, then provisioning and connecting to an EC2 instance.