Attacking AWS: The Full Cyber Kill Chain
summary
Walks through a repeatable AWS kill chain: SSRF to 169.254.169.254 exposes instance metadata and leaking role credentials, then PACU AWS exploitation framework enumerates permissions and finds a stopped instance with an admin profile, overwrites EC2 user-data startup shell to get a reverse shell, and escalates via CloudTrail tampering, Lambda backdoors, trust policy abuse and extra access keys. Demos real incident patterns and concrete mitigations like metadata proxying, org separation and automated config checks.
AI-written summary · about
chapters (10)
- 0:00AWS security risks
- 3:16AWS access key leaks
- 8:57SSRF in AWS exploitation
- 13:27PACU AWS exploitation
- 22:57Privilege escalation to admin
- 25:25Disabling monitoring to cover tracks
- 31:14ColdSpaces attack case study
- 33:27Preventing AWS breaches
- 37:50AWS monitoring and auditing
- 45:17Q&A
related talks
26mAWS (mis)configuration from an attacker’s-eye view
47mBringing a Machete to the Amazon
36mCloud Hacking Scenarios
36mGone in 60 milliseconds: Offensive security in the serverless age
20mFantastic AWS Attacks and Where to Find Them
43mThink like a HACKER
35mAccount Jumping Post Infection Persistency & Lateral Movement in AWS
40mBeyond Public Buckets: Lessons Learned on Attack Detection in the Cloud