Is it safe to use on production environments?

Users must obtain written authorization and follow strict constraints, ensuring they only test in-scope resources and avoid modifying production data without approval.

Does it support both IMDSv1 and IMDSv2 for metadata attacks?

Yes, the skill provides specific commands and workflows for extracting credentials from both versions of the EC2 Instance Metadata Service.

What tools are required for this AWS pentesting skill?

It utilizes the AWS CLI along with specialized tools like Pacu, Prowler, ScoutSuite, and Principal Mapper for comprehensive cloud auditing.

Can this skill help detect IAM privilege escalation?

Yes, it identifies specific 'Shadow Admin' permissions, such as iam:CreateAccessKey or iam:PassRole, that could allow a user to elevate their privileges to Administrator access.

AWS Pentesting & Cloud Security

Name: AWS Pentesting & Cloud Security
Author: claudiodearaujo

byclaudiodearaujo

•

Security & Testing

Conducts comprehensive security audits and penetration tests on AWS environments to identify vulnerabilities and privilege escalation paths.

The AWS Penetration Testing skill empowers developers and security professionals to evaluate the security posture of their cloud infrastructure. It provides expert guidance for IAM enumeration, exploiting SSRF via metadata endpoints (IMDSv1/v2), S3 bucket assessment, and Lambda function exploitation. By following standardized red-team workflows, users can identify misconfigurations, uncover 'Shadow Admin' permissions, and simulate real-world attack vectors to harden their AWS environments against unauthorized access and data breaches.

Key Features

01Automated metadata SSRF exploitation for EC2 and Fargate

02Integration with industry-standard tools like Pacu, Prowler, and ScoutSuite

031 GitHub stars

04S3 bucket discovery, enumeration, and security auditing

05IAM privilege escalation and Shadow Admin discovery

06Lambda code extraction and persistence technique identification

Use Cases

01Identifying and testing potential privilege escalation paths within IAM roles

02Validating the security of S3 buckets and Lambda functions against unauthorized access

03Performing a security audit on a new AWS environment to find misconfigurations

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add claudiodearaujo/sistema-de-narra-o-de-livro aws-penetration-testing

For use in Claude.ai and ChatGPT

Download Skill