Cloud Penetration Testing (AWS/Azure/GCP)
Advanced90 min5 objectives

Cloud Penetration Testing (AWS/Azure/GCP)

Complete Cloud Penetration Testing (AWS/Azure/GCP) in a deterministic practice workspace without depending on unavailable host, cloud, hardware, desktop, or multi-node infrastructure.

Briefing

### Scenario You are a aws practitioner handling a realistic client engagement. For Cloud Penetration Testing (AWS/Azure/GCP), the client has provided a staging environment that mirrors production but is isolated to this lab. Your task is to demonstrate the core technique on the local target without touching external systems. The scenario is intentionally scoped to what you can verify inside the container. ### Environment and scope Use the Ubuntu 22.04 practice container. Working directory is `/home/student/lab-work` (create it with `mkdir -p`). Target is `127.0.0.1` and `127.0.0.1:8080` where a `python3 -m http.server` or service-specific daemon runs. Install only needed tools via `sudo apt-get update && sudo apt-get install -y awscli, python3, jq` then verify with `aws --version 2>&1 | head`. Credentials: `student:lab123` with `sudo` (created via `useradd` + `chpasswd` + `sudoers.d` as in `labs.service.ts:554`). Do not scan or query outside 127.0.0.0/8 or lab-work. Scope is strictly container-only; no external cloud, hardware, or nested container engines. ### Mission objective For Cloud Penetration Testing (AWS/Azure/GCP): install and verify tooling, prepare the local target (`mock aws config in lab-work/cloud-config.yaml`), execute the technique step-by-step, and collect evidence. Each walkthrough step produces a verifiable artifact (file, command output, or service state) that you will cite in your submission. ### Success criteria You have completed the lab when: - Tooling verification passes (`aws --version 2>&1 | head` returns expected version without error) - Local target is running and responds (`curl -s http://127.0.0.1:8080/` or `dig @127.0.0.1` or `tshark -r` shows expected output) - `solution.md` in `lab-work` documents each step's exact command, raw output excerpt, and your interpretation (what the output proves) - All flag answers are direct values from your local output (e.g., version string, status code, IP, header name) and no external hosts were targeted (`history | grep -E "nmap|dig|tshark|openssl|nikto|curl"` shows only 127.0.0.1) Runtime mode: portable artifact validation

Objectives

  • 1Prepare workspace and verify tooling
  • 2Prepare local target for Cloud Penetration Testing (AWS/Azure/GCP)
  • 3Execute Cloud Penetration Testing (AWS/Azure/GCP) technique
  • 4Capture evidence
  • 5Complete Pacu Enumerator
  • 6Complete IMDS Exploiter
  • 7Tune and interpret
  • 8Compile and verify submission

Flags

Pacu Enumerator+150 pts

Submit the verifiable output value for Pacu Enumerator as produced by the local tool on 127.0.0.1 (e.g., version, status, IP, or header).

IMDS Exploiter+250 pts

Submit the verifiable output value for IMDS Exploiter as produced by the local tool on 127.0.0.1 (e.g., version, status, IP, or header).

IAM Escalator+250 pts

Submit the verifiable output value for IAM Escalator as produced by the local tool on 127.0.0.1 (e.g., version, status, IP, or header).

S3 Enumeratior+200 pts

Submit the verifiable output value for S3 Enumeratior as produced by the local tool on 127.0.0.1 (e.g., version, status, IP, or header).

ScoutSuite Auditor+150 pts

Submit the verifiable output value for ScoutSuite Auditor as produced by the local tool on 127.0.0.1 (e.g., version, status, IP, or header).

Deploy Lab — 30sCreate Free Account