gitea-mirror/hacktricks-cloud
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks-cloud.git synced 2026-07-28 22:51:09 -07:00
Code Issues Packages Projects Releases Wiki Activity

Translated ['', 'src/pentesting-cloud/aws-security/aws-unauthenticated-e

Browse Source
This commit is contained in:
Translator
2025-11-24 22:33:26 +00:00
parent 6f5ae06196
commit a38c7473c8
1 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/README.md
+8 -8
View File
@@ -4,8 +4,8 @@
## AWS Credentials Leaks
Njia ya kawaida ya kupata upatikanaji au taarifa kuhusu akaunti ya AWS ni kwa **searching for leaks**. Unaweza kutafuta leaks kwa kutumia **google dorks**, ukikagua **public repos** za **organization** na **workers** wa organization kwenye **Github** au majukwaa mengine, ukitafuta katika **credentials leaks databases**... au katika sehemu nyingine yoyote unayoona unaweza kupata taarifa kuhusu kampuni na miundombinu yake ya cloud.
Baadhi ya **tools** muhimu:
Njia ya kawaida ya kupata access au taarifa kuhusu akaunti ya AWS ni kwa **searching for leaks**. Unaweza kutafuta leaks kwa kutumia **google dorks**, ukikagua **public repos** za **organization** na **workers** wa organization kwenye **Github** au majukwaa mengine, ukitafuta katika **credentials leaks databases**... au katika sehemu nyingine yoyote unayoona kuna uwezekano kupata taarifa kuhusu kampuni na infa ya cloud yao.\
Baadhi ya **tools** zinazofaa:
- [https://github.com/carlospolop/leakos](https://github.com/carlospolop/leakos)
- [https://github.com/carlospolop/pastos](https://github.com/carlospolop/pastos)
@@ -13,7 +13,7 @@ Baadhi ya **tools** muhimu:
## AWS Unauthenticated Enum & Access
Kuna huduma kadhaa katika AWS ambazo zinaweza kusanidiwa kutoa aina fulani ya upatikanaji kwa watu wote wa Internet au kwa watu wengi zaidi kuliko ilivyotarajiwa. Angalia hapa jinsi:
Kuna huduma kadhaa katika AWS ambazo zinaweza kusanidiwa kutoa access kwa watu wote wa Internet au kwa watu zaidi kuliko ilivyotarajiwa. Angalia hapa jinsi:
- [**Accounts Unauthenticated Enum**](aws-accounts-unauthenticated-enum/index.html)
- [**API Gateway Unauthenticated Enum**](aws-api-gateway-unauthenticated-enum/index.html)
@@ -42,19 +42,19 @@ Kuna huduma kadhaa katika AWS ambazo zinaweza kusanidiwa kutoa aina fulani ya up
## Cross Account Attacks
Katika mazungumzo [**Breaking the Isolation: Cross-Account AWS Vulnerabilities**](https://www.youtube.com/watch?v=JfEFIcpJ2wk) wanaonyesha jinsi baadhi ya huduma zilivyowaruhusu (au ziliruhusu) akaunti yoyote ya AWS kuzipata kwa sababu **AWS services without specifying accounts ID** zilikuwa zimeruhusiwa.
Katika semina [**Breaking the Isolation: Cross-Account AWS Vulnerabilities**](https://www.youtube.com/watch?v=JfEFIcpJ2wk) inaonyesha jinsi huduma zingine zilivyoruhusu akaunti yoyote ya AWS kuzipata kwa sababu **AWS services without specifying accounts ID** zilikuwa zinakaribishwa.
Wakati wa mazungumzo walitoa mifano kadhaa, kama vile S3 buckets **allowing cloudtrai**l (of **any AWS** account) to **write to them**:
Wakati wa semina walitoa mifano kadhaa, kama vile S3 buckets **allowing cloudtrai**l (of **any AWS** account) to **write to them**:
![](<../../../images/image (260).png>)
Huduma nyingine zilizopatikana kuwa za hatari:
Huduma nyingine zilizogunduliwa kuwa zenye udhaifu:
- AWS Config
- Serverless repository
## Tools
## Zana
- [**cloud_enum**](https://github.com/initstring/cloud_enum): Zana ya OSINT kwa multi-cloud. **Find public resources** in AWS, Azure, and Google Cloud. Supported AWS services: Open / Protected S3 Buckets, awsapps (WorkMail, WorkDocs, Connect, etc.)
- [**cloud_enum**](https://github.com/initstring/cloud_enum): Zana ya OSINT ya multi-cloud. **Find public resources** in AWS, Azure, and Google Cloud. Inasaidia huduma za AWS: Open / Protected S3 Buckets, awsapps (WorkMail, WorkDocs, Connect, etc.)
{{#include ../../../banners/hacktricks-training.md}}