SEC588: Cloud Penetration Testing™

Overview

In this initial course section students will conduct the first phases of a cloud-focused penetration testing assessment. We will get familiar with how the terms of service, demarcation points, and limits imposed by cloud service providers function. The section features labs on how to perform scans and discovery jobs on an Internet scale that can be used in near real time and through historical searches to uncover target infrastructure and vulnerabilities. We will also describe how web scale affects reconnaissance and how to best address it. The section helps you manually build an asset discovery pipeline that you can use for your external and internal reconnaissance. This crucial part of the class helps you discover the vulnerabilities you will leverage for the rest of the course.

Exercises

• Domain Discovery Lab
• Portscans at Internet Scale
• Identifying and Scanning Systems for Vulnerabilities Using Tools like Nuclei
• Scaling Discovery with Frameworks like rEngine

Topics

• Testing Process
• Testing and Limitations
• Recon at Cloud Scale
• Domain Discovery Tools and Wordlists
• IP Addresses and Hosts
• Mapping URLs and Wordlists
• External Vulnerability Scanning
• Visualizations during Recon
• Asset Discovery Frameworks

Overview

Identity systems are crucial to cloud infrastructure. They are often used to access cloud providers, software services, and other cloud-related technologies. Identity systems can even provide data plane access, such as a VPN. In this section, we will examine the various identity systems, looking at authentication, authorization, and unauthenticated access. Walking through protocols such as OAuth and OpenIDConnect will give the tester a better understanding of the breaking point of these systems. We finish the section by leveraging an app consent phishing exercise using Microsoft Graph to backdoor access into Microsoft Products.

Exercises

• Hunting for Key Material
• Finding Valid Users in IdPs
• Password Attacks
• Hunting for Open File Shares
• App Consent Phishing and Microsoft Graph

Topics

• Introduction to Authentication
• Username Harvesting in the Cloud
• Username Harvesting Tools
• Passwords
• Open File Shares
• Introduction to Microsoft Cloud Services
• Azure AD
• Authentication Standards
• App Consent Phishing and Microsoft Graph

Overview

Cloud infrastructure lends itself to potential privilege escalation through mechanisms afforded to systems administrators and developers. We can abuse these features to move laterally, escalate privileges, or change our permission sets. This course section walks students through several Compute automation structures where we can perform attacks on cloud targets to show each use case. The section is hefty on labs to enforce the concepts of how these attacks operate with or without attacker tools.

Throughout the section, students will apply what they have learned from the previous two sections to abuse Compute, Identity, and Permissions in AWS and Azure. From looking for misconfigured AssumeRole issues in an account to leveraging an overly permissive account, we will show how you can go from the control plane to the data plane in an environment. The concepts learned apply to other clouds covered in the course, such as GCP, OCI and others.

Exercises

• CLI Tools
• EC2 Attack Setup
• Pacu Lab
• AssumeRole Lab
• Azure VMs
• Running Commands on Azure VMs

Topics

• AWS CLI
• Filtering and Output
• AWS IAM
• AWS KMS
• AWS IAM and Privilege Escalation
• AWS Compute
• Compute Attack Scenarios
• PACU
• Socat and Shells
• Confused Deputy
• Azure VMs
• Code Execution on Azure

Overview

This course section focuses on what are referred to as cloud-native applications. While we look at web applications themselves, the section is designed to show how cloud-native applications operate and how we can assess them. Applications in the wild are increasingly container-packaged and microservice-oriented. They are also primarily stateless applications that require different patterns to use. These applications will have their unique nuances. They will typically be deployed in a service mesh that could indicate a system like Kubernetes is being used. Some of the questions we will explore in this section include:

• Which application vulnerabilities are critical in my environment?
• How do Serverless and Lambda change my approach?
• What is the continuous integration/continuous delivery (CI/CD) pipeline, and how can it be abused?
• How do microservice applications operate?

The section will cover technologies such as AWS Lambda, Azure Functions, CI/CD pipelines, Terraform and Infrastructure as Code, Command Line injections and limitations between languages, and working with new and traditional databases.

Exercises

• Terraform State Files
• Backdooring CI/CD Pipelines
• SSRF Impacts on Cloud Environments
• Command Line Injections
• SQL Injections
• Attacks on Serverless Functions
• Databases, NoSQL, and Exposed Ports

Topics

• Introduction to Cloud Native Attacks
• Mapping Applications
• Infrastructure as Code
• Deployment Pipelines and Attacks
• Web Application Injections
• Server-Side Request Forgeries and Their Impacts
• Command Line Injections
• Serverless Functions Attacks
• Exposed Databases and Ports
• SQL Injections in Cloud Applications

Overview

This course section explores the world of Kubernetes and infrastructures, then dives into exploitation and red teaming in the cloud. Container technologies like Docker are explored in-depth. Since students will have a base understanding of our target environments by this point in the course, we will explore how to exploit what we have found, advance further into the environments, and finally move around laterally. The section will focus on breaking out containers, understanding service meshes, and exfiltrating data in various ways to show the real business impact of these attacks. We will wrap up the section by discussing strategies you can use to build attack infrastructure leveraging the cloud, including exploring strategies you can use with cloud providers to conduct operations on the target infrastructure.

Exercises

• Docker Labs
• Kubernetes and Peirates Lab
• Backdooring Containers
• Web Shells
• Domain Fronting

Topics

• Docker
• Kubernetes
• Backdooring Containers
• Red Team and Exploitation
• Payloads and Payload Selection
• Red Team Ops in the Cloud
• Obfuscating in the Cloud

Overview

In the final course section, be prepared to work as a team and complete an end-to-end assessment in a new cloud environment. The applications and settings are all newly designed to imitate real-world environments. This capstone event allows students to put together the all the knowledge acquired during the week, reinforce theory and practice, and simulate an end-to-end test. Students will be asked to write a report using a method that is easy to read for both developers and administrative staff. We will provide students with a few rubrics and ways to work through the scenarios. There are always new and novel solutions, and we like students to share what they have learned and how they did what they did with one another.