Cloud Hacking Scenarios
summary
Shows concrete attack chains: credentials in HTML and git (regex finds AKIA keys), GitHub secrets lead to Office365 logins then a SharePoint PDF with Jira admin creds, and root account recovery via exposed webmail yields control of 20–30 AWS accounts. Public Kubernetes APIs found with Shodan/BinaryEdge scans expose Secrets and Jenkins config; port‑forwarding plus a Jenkins job that runs AWS CLI -> admin keys gives full cloud control. Finds ~300 new public cluster IPs per month and hundreds of leaked Office365 accounts; no MFA or least‑privilege causes most breaches.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 0:50Simple HTML
- 2:16GitHub
- 8:54Symphony
- 14:54Kubernetes
- 15:14Search Engines
- 15:52Secrets
- 16:45Deep Dive
- 18:58What went wrong
- 21:06Principle of Least Privilege
- 24:16Examples
related talks
36mCloud Hacking Scenarios
31mCloud Hacking Scenarios
56mHack the Cloud Hack the Company: the Cloud Impact on Enterprise Security
45mLive Hacking Cloud Architectures
47mBreaking the Cloud to Rebuild It: A Tale of 3 ☁️ Breaches!
40mBlind Spots: Two Cloud Threats You Didn’t Even Know You Had
33mLive Hacking Cloud Architectures - Thorsten Jakoby and Mirna Alaisami
33mGaining initial access by exploiting leaked credentials