CoreQ Academy4.6 Given a scenario, perform cloud-based attacks using the appropriate tools.
Cloud attacks mostly abuse identity and configuration rather than software bugs. Stay within the provider's testing policy and the client's scope.
Attack types
- Metadata service attacks
- Using SSRF or host access to read instance metadata and steal temporary credentials.
- Identity and access management misconfigurations
- Over-permissive roles, wildcard policies, or roles that can escalate their own privileges.
- Third-party integrations
- Abusing trusted SaaS or CI integrations with broad access to the cloud account.
- Resource misconfiguration
- Insecure settings on cloud resources.
- Network segmentation
- Flat VPCs or permissive peering that allow lateral movement.
- Network controls
- Security groups or NACLs open to 0.0.0.0/0.
- Identity and access management (IAM) credentials
- Long-lived access keys leaked or overly privileged.
- Exposed storage buckets
- Publicly readable or writable buckets.
- Public access to services
- Databases, dashboards or admin APIs reachable from the internet.
- Logging information exposure
- Logs containing secrets or tokens readable by too many identities.
- Image and artifact tampering
- Modifying images or build artifacts in registries to plant malicious code.
- Supply chain attacks
- Compromising dependencies, pipelines or third-party components that the cloud workload trusts.
- Workload runtime attacks
- Attacking running functions, containers or VMs.
- Container escape
- Breaking out of a container to the host, often via privileged containers or mounted sockets.
- Trust relationship abuse
- Abusing cross-account roles or federation trusts to move between accounts.
Tools
- Pacu
- AWS exploitation framework for testing IAM and service misconfigurations.
- Docker Bench
- Checks Docker hosts and containers against CIS best practices.
- Kube-hunter
- Finds weaknesses in Kubernetes clusters.
- Prowler
- Security assessment tool for AWS, Azure and Google Cloud against best practices and compliance frameworks.
- ScoutSuite
- Multi-cloud security auditing tool that reports misconfigurations.
- Cloud-native vendor tools
- Provider tools such as security posture dashboards and IAM analysers.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 4.6 of the publicly available CompTIA PenTest+ PT0-003 exam objectives (Exam objectives V3, document version 5.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.