Writeups

Link Notes
Fantastic AWS Hacks and Where to Find Them
  • Getting started in AWS security, and how companies are getting hacked on AWS
  • Related interactive mindmap
AWS Phishing: Four Ways Some common phishing tactics in AWS:
  • Credential Phishing
  • Device Authentication Phishing
  • CloudFormation Stack Phishing
  • ACM Email Validation Phishing
Public Access Key - 2023 Timeline of events when an AWS IAM Access Key was published to GitHub
CSRF: A complete guide to exploiting advanced CSRF vulnerabilities How to identify CSRF vulnerabilities while also covering basic and advanced exploitation methods.
Investigating Persistence Mechanisms in AWS Rapid7 Labs details four AWS persistence techniques used by attackers: rogue IAM user creation, backdoored assume role policies granting external account access, malicious Lambda functions provisioning privileged users, and federated user sessions that survive key rotation. Includes LEQL detection queries and remediation steps