Hacking Multi-Cloud Infrastructure

Course Outline

Cloud environments are very different from traditional on prem environments. While the development world has swiftly moved to the cloud, pentesters are still focused on old techniques, we still see people asking about how to get a shell in a cloud environment. As much as the charm of getting shell is good, cloud being a infrastructure not effectively owned by the organization brings in a lot of different aspects from an attackers point of view. This opens avenues where shell is the least of your worries and there are hundreds of other ways by which massive damage can be inflicted on the organisations.

Today’s world is run on apps. Apps that are hosted on the cloud with their entire infrastructure transparent and invisible to the average user. Defending this infrastructure requires an intimate understanding of how attackers see these different services line up and make the infrastructure that you see and use as everyday apps. Attacking any cloud based system requires an understanding of how cloud resources all come together, how they interact and how do we attack, abuse and bypass security controls around them, what misconfigurations lie within the cloud and how these misconfigurations can be used to escalate privileges, gain access to data and even perform inter cloud hops to gain access across the entire cloud estate.

This hands-on focused training will take you on a path as an attacker, focused on breaking apps and services in Google Cloud, Amazon Web Services, DigitalOcean and the often ignored Alibaba Cloud through various interactive and hands-on scenario-driven labs.

If these questions are of interest to you and you want to learn to achieve the answers, then this training is for you:

  1. How can I enumerate S3 permissions remotely without credentials?
  2. Can I tell who owns a bucket I have discovered?
  3. What vulnerabilities, like SSRF, can be used to abuse IMDSv2?
  4. How do I enumerate and abuse AWS IAM permissions?
  5. How do I escape to the cloud layer from my GKE cluster on Google Cloud?
  6. How do we discover vulnerable GKE clusters on the Internet?
  7. How does service account impersonation work in Google Cloud? What can I do with it?
  8. What triggers can be abused to attack AWS Lambda?
  9. What other uncommon AWS services can be attacked?
  10. How do I attack DigitalOcean services?
  11. How do I discover and hack into DigitalOcean Spaces?
  12. Can we jump across multi-cloud environments using native tools?
  13. Can we find and exploit Alibaba ECS Virtual Machines on the Internet?
  14. How do we enum and exploit Alibaba Cloud Object Storage service?
  15. Is Alibaba Cloud IAM really that secure?

As part of the training, students will learn to enumerate, discover, exploit and jump across various cloud services. The training will cover real-world scenarios recreated from pentesting engagements and popular cloud related data breaches.

Student Requirements

  1. Familiarity with Security Testing Basics like XSS, SQL Injection at least OWASP Top 10’s. We will be using these to gain access.
  2. Familiarity with the AWS, Google Cloud, DigitalOcean and Aliyun web consoles – The consoles are very intuitive and can be used even by folks who have never seen it before.
  3. Familiarity with linux command line tools (grep,cut, dig, nslookup, vim, ssh or so). Students will be provided with command cheat sheets but basic understanding is helpful.
  4. High level understanding of cloud specific technologies like kubernetes and terraform is good to have.

Some good references to be checked before course 

  1. https://cloud.google.com/docs/get-started/aws-azure-gcp-service-comparison
  2. https://www.cncf.io/phippy/the-childrens-illustrated-guide-to-kubernetes/ 

What students should bring

  1. Laptop with a modern OS Windows 10/OSX/Linux with internet connection.
  2. Updated browsers such as Chrome, Firefox
  3. Activated cloud accounts would be required for following providers
    1. AWS 
    2. Google Cloud
    3. Digital Ocean
    4. Aliyun

Please ensure you are using your own account as sharing accounts between students can result in some of the labs to work incorrectly.

What students will be provided with

  • Very Detailed step-by-step instruction manual for all challenges covered during the class.
  • A Slide deck containing the slides covered during the class.
  • Access to terraform scripts for the environment setup after class

Next Sessions

Testimonials

Recent Previous Run of this class

How to attend

Cyfinoid offers its trainings via multiple international conference such as BlackHat USA and others.

Contact Us for Private / Corporate Session

Scroll to Top