translate 2

src/pentesting-cloud/aws-security/README.md

@@ -392,4 +392,3 @@ aws ...
 
 
 
-

src/pentesting-cloud/aws-security/aws-basic-information/README.md

@@ -389,4 +389,3 @@ If you are looking for something **similar** to this but for the **browser** you
 
 
 
-

src/pentesting-cloud/aws-security/aws-basic-information/aws-federation-abuse.md

@@ -132,4 +132,3 @@ In order to specify **which service account should be able to assume the role,**
 
 
 
-

src/pentesting-cloud/aws-security/aws-permissions-for-a-pentest.md

@@ -20,4 +20,3 @@ These are the permissions you need on each AWS account you want to audit to be a
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/README.md

@@ -4,5 +4,3 @@
 
 
 
-
-

src/pentesting-cloud/aws-security/aws-persistence/aws-api-gateway-persistence.md

@@ -35,4 +35,3 @@ Or just remove the use of API keys.
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-cognito-persistence.md

@@ -45,4 +45,3 @@ By default this is disabled:
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-dynamodb-persistence.md

@@ -66,4 +66,3 @@ The compromised instances or Lambda functions can periodically check the C2 tabl
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-ec2-persistence.md

@@ -57,4 +57,3 @@ Create a peering connection between the victim VPC and the attacker VPC so he wi
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-ecr-persistence.md

@@ -100,4 +100,3 @@ aws ecr put-replication-configuration \
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-ecs-persistence.md

@@ -102,4 +102,3 @@ aws ecs create-service --service-name "undocumented-service" --task-definition "
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-efs-persistence.md

@@ -24,4 +24,3 @@ You could **create an access point** (with root access to `/`) accessible from a
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-elastic-beanstalk-persistence.md

@@ -80,4 +80,3 @@ aws elasticbeanstalk update-environment --environment-name my-env --option-setti
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-iam-persistence.md

@@ -52,4 +52,3 @@ If the account is already trusting a common identity provider (such as Github) t
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-kms-persistence.md

@@ -42,4 +42,3 @@ aws kms list-grants --key-id <key-id>
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/README.md

@@ -67,4 +67,3 @@ Here you have some ideas to make your **presence in AWS more stealth by creating
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-abusing-lambda-extensions.md

@@ -45,4 +45,3 @@ The tool [**lambda-spy**](https://github.com/clearvector/lambda-spy) was created
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-layers-persistence.md

@@ -133,4 +133,3 @@ aws lambda remove-layer-version-permission --layer-name ExternalBackdoor --state
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-lightsail-persistence.md

@@ -36,4 +36,3 @@ If domains are configured:
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-rds-persistence.md

@@ -34,4 +34,3 @@ aws rds modify-db-snapshot-attribute --db-snapshot-identifier <snapshot-name> --
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-s3-persistence.md

@@ -28,4 +28,3 @@ Although usually ACLs of buckets are disabled, an attacker with enough privilege
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-secrets-manager-persistence.md

@@ -56,4 +56,3 @@ def generate_password():
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-sns-persistence.md

@@ -84,4 +84,3 @@ aws sns subscribe --region <region> \
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-sqs-persistence.md

@@ -42,4 +42,3 @@ The following policy gives everyone in AWS access to everything in the queue cal
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-ssm-perssitence.md

@@ -4,5 +4,3 @@
 
 
 
-
-

src/pentesting-cloud/aws-security/aws-persistence/aws-step-functions-persistence.md

@@ -24,4 +24,3 @@ If the AWS account is using aliases to call step functions it would be possible
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-sts-persistence.md

@@ -134,4 +134,3 @@ Write-Host "Role juggling check complete."
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/README.md

@@ -4,5 +4,3 @@
 
 
 
-
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-api-gateway-post-exploitation.md

@@ -149,4 +149,3 @@ aws apigateway create-usage-plan-key --usage-plan-id $USAGE_PLAN --key-id $API_K
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-cloudfront-post-exploitation.md

@@ -34,4 +34,3 @@ You can check the [**tf code to recreate this scenarios here**](https://github.c
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/README.md

@@ -87,4 +87,3 @@ aws codebuild delete-source-credentials --arn <value>
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/aws-codebuild-token-leakage.md

@@ -191,4 +191,3 @@ aws codebuild start-build --project-name <proj-name>
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-control-tower-post-exploitation.md

@@ -23,4 +23,3 @@ aws controltower enable-control --control-identifier <arn_control_id> --target-i
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dlm-post-exploitation.md

@@ -98,4 +98,3 @@ A template for the policy document can be seen here:
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dynamodb-post-exploitation.md

@@ -352,4 +352,3 @@ bashCopy codeaws dynamodbstreams get-records \
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/README.md

@@ -480,4 +480,3 @@ if __name__ == "__main__":
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ebs-snapshot-dump.md

@@ -144,4 +144,3 @@ You can use this tool to automate the attack: [https://github.com/Static-Flow/Cl
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-malicious-vpc-mirror.md

@@ -18,4 +18,3 @@ For more information and access to the [**malmirror script**](https://github.com
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecr-post-exploitation.md

@@ -99,4 +99,3 @@ aws ecr-public batch-delete-image --repository-name your-ecr-repo-name --image-i
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecs-post-exploitation.md

@@ -66,4 +66,3 @@ The EC2 instance will probably also have the permission `ecr:GetAuthorizationTok
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-efs-post-exploitation.md

@@ -57,4 +57,3 @@ aws efs delete-access-point --access-point-id <value>
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-eks-post-exploitation.md

@@ -158,4 +158,3 @@ So, if an **attacker compromises a cluster using fargate** and **removes all the
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-elastic-beanstalk-post-exploitation.md

@@ -83,4 +83,3 @@ aws elasticbeanstalk remove-tags --resource-arn arn:aws:elasticbeanstalk:us-west
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-iam-post-exploitation.md

@@ -106,4 +106,3 @@ A common way to avoid Confused Deputy problems is the use of a condition with `A
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-kms-post-exploitation.md

@@ -136,4 +136,3 @@ aws kms schedule-key-deletion \
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/README.md

@@ -32,4 +32,3 @@ Abusing Lambda Layers it's also possible to abuse extensions and persist in the
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-warm-lambda-persistence.md

@@ -66,4 +66,3 @@ For more info check [https://github.com/carlospolop/lambda_bootstrap_switcher](h
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lightsail-post-exploitation.md

@@ -33,4 +33,3 @@ Check out the Lightsail privesc options to learn different ways to access potent
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-organizations-post-exploitation.md

@@ -22,4 +22,3 @@ aws organizations deregister-account --account-id <account_id> --region <region>
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-rds-post-exploitation.md

@@ -95,4 +95,3 @@ aws rds start-export-task --export-task-identifier attacker-export-task --source
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-s3-post-exploitation.md

@@ -41,4 +41,3 @@ Finally, the attacker could upload a final file, usually named "ransom-note.txt,
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-secrets-manager-post-exploitation.md

@@ -52,4 +52,3 @@ aws secretsmanager delete-secret \
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ses-post-exploitation.md

@@ -86,4 +86,3 @@ Still to test.
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation.md

@@ -83,4 +83,3 @@ aws sns untag-resource --resource-arn <value> --tag-keys <key>
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sqs-post-exploitation.md

@@ -90,4 +90,3 @@ arduinoCopy codeaws sqs remove-permission --queue-url <value> --label <value>
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sso-and-identitystore-post-exploitation.md

@@ -28,4 +28,3 @@ aws sso-admin delete-account-assignment --instance-arn <SSOInstanceARN> --target
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-stepfunctions-post-exploitation.md

@@ -77,4 +77,3 @@ aws stepfunctions untag-resource --resource-arn <value> --tag-keys <key>
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sts-post-exploitation.md

@@ -51,7 +51,6 @@ resp=$(curl -s "$federation_endpoint" \
 signin_token=$(echo -n $resp | jq -r '.SigninToken' | tr -d '\n' | jq -sRr @uri)
 
 
-
 # Give the URL to login
 echo -n "https://signin.aws.amazon.com/federation?Action=login&Issuer=example.com&Destination=https%3A%2F%2Fconsole.aws.amazon.com%2F&SigninToken=$signin_token"
 ```
@@ -107,4 +106,3 @@ response = client.get_secret_value(SecretId="flag_secret") print(response['Secre
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-vpn-post-exploitation.md

@@ -16,4 +16,3 @@ For more information:
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/README.md

@@ -25,4 +25,3 @@ The way to escalate your privileges in AWS is to have enough permissions to be a
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-apigateway-privesc.md

@@ -110,4 +110,3 @@ aws apigateway update-vpc-link --vpc-link-id $VPC_LINK_ID --patch-operations op=
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-chime-privesc.md

@@ -12,4 +12,3 @@ TODO
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudformation-privesc/README.md

@@ -120,4 +120,3 @@ An attacker could abuse this permission without the passRole permission to updat
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudformation-privesc/iam-passrole-cloudformation-createstack-and-cloudformation-describestacks.md

@@ -83,4 +83,3 @@ aws cloudformation describe-stacks \
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codebuild-privesc.md

@@ -351,4 +351,3 @@ More details could be found [here](https://www.shielder.com/blog/2023/07/aws-cod
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codepipeline-privesc.md

@@ -39,4 +39,3 @@ It might be possible to modify the role used and the command executed on a codep
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/README.md

@@ -75,4 +75,3 @@ You can find the exploit in [https://github.com/RhinoSecurityLabs/Cloud-Security
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/codestar-createproject-codestar-associateteammember.md

@@ -83,4 +83,3 @@ This is the created policy the user can privesc to (the project name was `superc
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/iam-passrole-codestar-createproject.md

@@ -90,4 +90,3 @@ This exploit is based on the **Pacu exploit of these privileges**: [https://gith
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cognito-privesc.md

@@ -316,4 +316,3 @@ For more information check [https://github.com/padok-team/cognito-scanner](https
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-datapipeline-privesc.md

@@ -76,4 +76,3 @@ The **pipeline definition file, crafted by the attacker, includes directives to
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-directory-services-privesc.md

@@ -36,4 +36,3 @@ There isn't apparently any way to enable the application access URL, the AWS Man
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-dynamodb-privesc.md

@@ -25,4 +25,3 @@ As far as I know there is **no direct way to escalate privileges in AWS just by
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ebs-privesc.md

@@ -29,4 +29,3 @@ You can use this tool to automate the attack: [https://github.com/Static-Flow/Cl
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc.md

@@ -293,4 +293,3 @@ Assuming we find `aws_access_key_id` and `aws_secret_access_key`, we can use the
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ecr-privesc.md

@@ -110,4 +110,3 @@ aws ecr set-repository-policy \
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ecs-privesc.md

@@ -252,4 +252,3 @@ aws ecs update-service-primary-task-set --cluster existing-cluster --service exi
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-efs-privesc.md

@@ -99,4 +99,3 @@ aws efs modify-mount-target-security-groups \
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-elastic-beanstalk-privesc.md

@@ -187,4 +187,3 @@ The developer has intentions to establish a reverse shell using Netcat or Socat
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-emr-privesc.md

@@ -67,4 +67,3 @@ The URL of the notebook is `https://<notebook-id>.emrnotebooks-prod.eu-west-1.am
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-gamelift.md

@@ -20,4 +20,3 @@ aws gamelift request-upload-credentials \
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-glue-privesc.md

@@ -94,4 +94,3 @@ Just with the update permission an attacked could steal the IAM Credentials of t
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc.md

@@ -275,4 +275,3 @@ aws iam update-open-id-connect-provider-thumbprint --open-id-connect-provider-ar
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-kms-privesc.md

@@ -125,4 +125,3 @@ For more information check:
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc.md

@@ -294,4 +294,3 @@ Some lambdas are going to be **receiving sensitive info from the users in parame
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lightsail-privesc.md

@@ -164,4 +164,3 @@ aws lightsail update-domain-entry \
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-mediapackage-privesc.md

@@ -28,4 +28,3 @@ aws mediapackage rotate-ingest-endpoint-credentials --id test --ingest-endpoint-
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-mq-privesc.md

@@ -52,4 +52,3 @@ If you could somehow find the original credentials used by ActiveMQ you could pe
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-msk-privesc.md

@@ -26,4 +26,3 @@ If **IAM role-based authentication** is used and **kafka is publicly exposed** y
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-organizations-prinvesc.md

@@ -21,4 +21,3 @@ To [**learn how check this page**](../#compromising-the-organization).
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-rds-privesc.md

@@ -172,4 +172,3 @@ aws rds add-role-to-db-instance --db-instance-identifier target-instance --role-
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-redshift-privesc.md

@@ -109,4 +109,3 @@ Check [https://docs.aws.amazon.com/redshift/latest/dg/loading-data-from-emr.html
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-s3-privesc.md

@@ -185,4 +185,3 @@ aws s3api put-object-acl --bucket <bucket-name> --key flag --version-id <value>
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sagemaker-privesc.md

@@ -116,4 +116,3 @@ An attacker with those permissions will (potentially) be able to create an **hyp
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-secrets-manager-privesc.md

@@ -53,4 +53,3 @@ policy.json:
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sns-privesc.md

@@ -46,4 +46,3 @@ aws sns add-permission --topic-arn <value> --label <value> --aws-account-id <val
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sqs-privesc.md

@@ -49,4 +49,3 @@ aws sqs change-message-visibility --queue-url <value> --receipt-handle <value> -
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ssm-privesc.md

@@ -134,4 +134,3 @@ aws-codebuild-privesc.md
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sso-and-identitystore-privesc.md

@@ -134,4 +134,3 @@ aws sso-admin   delete-permissions-boundary-from-permission-set --instance-arn <
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-stepfunctions-privesc.md

@@ -256,4 +256,3 @@ aws stepfunctions update-state-machine --state-machine-arn arn:aws:states:us-eas
 
 
 
-