trasnlate other half

src/pentesting-cloud/aws-security/README.md

@@ -391,3 +391,5 @@ aws ...
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-basic-information/README.md

@@ -388,3 +388,5 @@ If you are looking for something **similar** to this but for the **browser** you
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-basic-information/aws-federation-abuse.md

@@ -131,3 +131,5 @@ In order to specify **which service account should be able to assume the role,**
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-permissions-for-a-pentest.md

@@ -19,3 +19,5 @@ These are the permissions you need on each AWS account you want to audit to be a
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/README.md

@@ -4,3 +4,5 @@
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-api-gateway-persistence.md

@@ -34,3 +34,5 @@ Or just remove the use of API keys.
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-cognito-persistence.md

@@ -44,3 +44,5 @@ By default this is disabled:
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-dynamodb-persistence.md

@@ -65,3 +65,5 @@ The compromised instances or Lambda functions can periodically check the C2 tabl
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-ec2-persistence.md

@@ -56,3 +56,5 @@ Create a peering connection between the victim VPC and the attacker VPC so he wi
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-ecr-persistence.md

@@ -99,3 +99,5 @@ aws ecr put-replication-configuration \
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-ecs-persistence.md

@@ -101,3 +101,5 @@ aws ecs create-service --service-name "undocumented-service" --task-definition "
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-efs-persistence.md

@@ -23,3 +23,5 @@ You could **create an access point** (with root access to `/`) accessible from a
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-elastic-beanstalk-persistence.md

@@ -79,3 +79,5 @@ aws elasticbeanstalk update-environment --environment-name my-env --option-setti
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-iam-persistence.md

@@ -51,3 +51,5 @@ If the account is already trusting a common identity provider (such as Github) t
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-kms-persistence.md

@@ -41,3 +41,5 @@ aws kms list-grants --key-id <key-id>
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/README.md

@@ -66,3 +66,5 @@ Here you have some ideas to make your **presence in AWS more stealth by creating
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-abusing-lambda-extensions.md

@@ -44,3 +44,5 @@ The tool [**lambda-spy**](https://github.com/clearvector/lambda-spy) was created
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-layers-persistence.md

@@ -132,3 +132,5 @@ aws lambda remove-layer-version-permission --layer-name ExternalBackdoor --state
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-lightsail-persistence.md

@@ -35,3 +35,5 @@ If domains are configured:
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-rds-persistence.md

@@ -33,3 +33,5 @@ aws rds modify-db-snapshot-attribute --db-snapshot-identifier <snapshot-name> --
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-s3-persistence.md

@@ -27,3 +27,5 @@ Although usually ACLs of buckets are disabled, an attacker with enough privilege
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-secrets-manager-persistence.md

@@ -55,3 +55,5 @@ def generate_password():
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-sns-persistence.md

@@ -83,3 +83,5 @@ aws sns subscribe --region <region> \
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-sqs-persistence.md

@@ -41,3 +41,5 @@ The following policy gives everyone in AWS access to everything in the queue cal
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-ssm-perssitence.md

@@ -4,3 +4,5 @@
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-step-functions-persistence.md

@@ -23,3 +23,5 @@ If the AWS account is using aliases to call step functions it would be possible
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-sts-persistence.md

@@ -133,3 +133,5 @@ Write-Host "Role juggling check complete."
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/README.md

@@ -4,3 +4,5 @@
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-api-gateway-post-exploitation.md

@@ -148,3 +148,5 @@ aws apigateway create-usage-plan-key --usage-plan-id $USAGE_PLAN --key-id $API_K
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-cloudfront-post-exploitation.md

@@ -33,3 +33,5 @@ You can check the [**tf code to recreate this scenarios here**](https://github.c
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/README.md

@@ -86,3 +86,5 @@ aws codebuild delete-source-credentials --arn <value>
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/aws-codebuild-token-leakage.md

@@ -190,3 +190,5 @@ aws codebuild start-build --project-name <proj-name>
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-control-tower-post-exploitation.md

@@ -22,3 +22,5 @@ aws controltower enable-control --control-identifier <arn_control_id> --target-i
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dlm-post-exploitation.md

@@ -97,3 +97,5 @@ A template for the policy document can be seen here:
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dynamodb-post-exploitation.md

@@ -351,3 +351,5 @@ bashCopy codeaws dynamodbstreams get-records \
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/README.md

@@ -479,3 +479,5 @@ if __name__ == "__main__":
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ebs-snapshot-dump.md

@@ -143,3 +143,5 @@ You can use this tool to automate the attack: [https://github.com/Static-Flow/Cl
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-malicious-vpc-mirror.md

@@ -17,3 +17,5 @@ For more information and access to the [**malmirror script**](https://github.com
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecr-post-exploitation.md

@@ -98,3 +98,5 @@ aws ecr-public batch-delete-image --repository-name your-ecr-repo-name --image-i
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecs-post-exploitation.md

@@ -65,3 +65,5 @@ The EC2 instance will probably also have the permission `ecr:GetAuthorizationTok
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-efs-post-exploitation.md

@@ -56,3 +56,5 @@ aws efs delete-access-point --access-point-id <value>
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-eks-post-exploitation.md

@@ -157,3 +157,5 @@ So, if an **attacker compromises a cluster using fargate** and **removes all the
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-elastic-beanstalk-post-exploitation.md

@@ -82,3 +82,5 @@ aws elasticbeanstalk remove-tags --resource-arn arn:aws:elasticbeanstalk:us-west
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-iam-post-exploitation.md

@@ -105,3 +105,5 @@ A common way to avoid Confused Deputy problems is the use of a condition with `A
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-kms-post-exploitation.md

@@ -135,3 +135,5 @@ aws kms schedule-key-deletion \
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/README.md

@@ -31,3 +31,5 @@ Abusing Lambda Layers it's also possible to abuse extensions and persist in the
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-warm-lambda-persistence.md

@@ -65,3 +65,5 @@ For more info check [https://github.com/carlospolop/lambda_bootstrap_switcher](h
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lightsail-post-exploitation.md

@@ -32,3 +32,5 @@ Check out the Lightsail privesc options to learn different ways to access potent
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-organizations-post-exploitation.md

@@ -21,3 +21,5 @@ aws organizations deregister-account --account-id <account_id> --region <region>
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-rds-post-exploitation.md

@@ -94,3 +94,5 @@ aws rds start-export-task --export-task-identifier attacker-export-task --source
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-s3-post-exploitation.md

@@ -40,3 +40,5 @@ Finally, the attacker could upload a final file, usually named "ransom-note.txt,
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-secrets-manager-post-exploitation.md

@@ -51,3 +51,5 @@ aws secretsmanager delete-secret \
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ses-post-exploitation.md

@@ -85,3 +85,5 @@ Still to test.
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation.md

@@ -82,3 +82,5 @@ aws sns untag-resource --resource-arn <value> --tag-keys <key>
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sqs-post-exploitation.md

@@ -89,3 +89,5 @@ arduinoCopy codeaws sqs remove-permission --queue-url <value> --label <value>
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sso-and-identitystore-post-exploitation.md

@@ -27,3 +27,5 @@ aws sso-admin delete-account-assignment --instance-arn <SSOInstanceARN> --target
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-stepfunctions-post-exploitation.md

@@ -76,3 +76,5 @@ aws stepfunctions untag-resource --resource-arn <value> --tag-keys <key>
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sts-post-exploitation.md

@@ -106,3 +106,5 @@ response = client.get_secret_value(SecretId="flag_secret") print(response['Secre
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-vpn-post-exploitation.md

@@ -15,3 +15,5 @@ For more information:
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/README.md

@@ -25,3 +25,4 @@ The way to escalate your privileges in AWS is to have enough permissions to be a
 
 
 
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-apigateway-privesc.md

@@ -109,3 +109,5 @@ aws apigateway update-vpc-link --vpc-link-id $VPC_LINK_ID --patch-operations op=
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-chime-privesc.md

@@ -11,3 +11,5 @@ TODO
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudformation-privesc/README.md

@@ -120,3 +120,4 @@ An attacker could abuse this permission without the passRole permission to updat
 
 
 
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudformation-privesc/iam-passrole-cloudformation-createstack-and-cloudformation-describestacks.md

@@ -83,3 +83,4 @@ aws cloudformation describe-stacks \
 
 
 
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codebuild-privesc.md

@@ -351,3 +351,4 @@ More details could be found [here](https://www.shielder.com/blog/2023/07/aws-cod
 
 
 
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codepipeline-privesc.md

@@ -39,3 +39,4 @@ It might be possible to modify the role used and the command executed on a codep
 
 
 
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/README.md

@@ -75,3 +75,4 @@ You can find the exploit in [https://github.com/RhinoSecurityLabs/Cloud-Security
 
 
 
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/codestar-createproject-codestar-associateteammember.md

@@ -83,3 +83,4 @@ This is the created policy the user can privesc to (the project name was `superc
 
 
 
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/iam-passrole-codestar-createproject.md

@@ -90,3 +90,4 @@ This exploit is based on the **Pacu exploit of these privileges**: [https://gith
 
 
 
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cognito-privesc.md

@@ -316,3 +316,4 @@ For more information check [https://github.com/padok-team/cognito-scanner](https
 
 
 
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-datapipeline-privesc.md

@@ -76,3 +76,4 @@ The **pipeline definition file, crafted by the attacker, includes directives to
 
 
 
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-directory-services-privesc.md

@@ -36,3 +36,4 @@ There isn't apparently any way to enable the application access URL, the AWS Man
 
 
 
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-dynamodb-privesc.md

@@ -25,3 +25,4 @@ As far as I know there is **no direct way to escalate privileges in AWS just by
 
 
 
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ebs-privesc.md

@@ -29,3 +29,4 @@ You can use this tool to automate the attack: [https://github.com/Static-Flow/Cl
 
 
 
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc.md

@@ -293,3 +293,4 @@ Assuming we find `aws_access_key_id` and `aws_secret_access_key`, we can use the
 
 
 
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ecr-privesc.md

@@ -110,3 +110,4 @@ aws ecr set-repository-policy \
 
 
 
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ecs-privesc.md

@@ -252,3 +252,4 @@ aws ecs update-service-primary-task-set --cluster existing-cluster --service exi
 
 
 
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-efs-privesc.md

@@ -98,3 +98,5 @@ aws efs modify-mount-target-security-groups \
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-elastic-beanstalk-privesc.md

@@ -187,3 +187,4 @@ The developer has intentions to establish a reverse shell using Netcat or Socat
 
 
 
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-emr-privesc.md

@@ -66,3 +66,5 @@ The URL of the notebook is `https://<notebook-id>.emrnotebooks-prod.eu-west-1.am
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-gamelift.md

@@ -20,3 +20,4 @@ aws gamelift request-upload-credentials \
 
 
 
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-glue-privesc.md

@@ -94,3 +94,4 @@ Just with the update permission an attacked could steal the IAM Credentials of t
 
 
 
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc.md

@@ -275,3 +275,4 @@ aws iam update-open-id-connect-provider-thumbprint --open-id-connect-provider-ar
 
 
 
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-kms-privesc.md

@@ -124,3 +124,5 @@ For more information check:
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc.md

@@ -294,3 +294,4 @@ Some lambdas are going to be **receiving sensitive info from the users in parame
 
 
 
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lightsail-privesc.md

@@ -164,3 +164,4 @@ aws lightsail update-domain-entry \
 
 
 
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-mediapackage-privesc.md

@@ -27,3 +27,5 @@ aws mediapackage rotate-ingest-endpoint-credentials --id test --ingest-endpoint-
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-mq-privesc.md

@@ -51,3 +51,5 @@ If you could somehow find the original credentials used by ActiveMQ you could pe
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-msk-privesc.md

@@ -26,3 +26,4 @@ If **IAM role-based authentication** is used and **kafka is publicly exposed** y
 
 
 
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-organizations-prinvesc.md

@@ -20,3 +20,5 @@ To [**learn how check this page**](../#compromising-the-organization).
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-rds-privesc.md

@@ -171,3 +171,5 @@ aws rds add-role-to-db-instance --db-instance-identifier target-instance --role-
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-redshift-privesc.md

@@ -109,3 +109,4 @@ Check [https://docs.aws.amazon.com/redshift/latest/dg/loading-data-from-emr.html
 
 
 
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-s3-privesc.md

@@ -185,3 +185,4 @@ aws s3api put-object-acl --bucket <bucket-name> --key flag --version-id <value>
 
 
 
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sagemaker-privesc.md

@@ -116,3 +116,4 @@ An attacker with those permissions will (potentially) be able to create an **hyp
 
 
 
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-secrets-manager-privesc.md

@@ -53,3 +53,4 @@ policy.json:
 
 
 
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sns-privesc.md

@@ -45,3 +45,5 @@ aws sns add-permission --topic-arn <value> --label <value> --aws-account-id <val
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sqs-privesc.md

@@ -48,3 +48,5 @@ aws sqs change-message-visibility --queue-url <value> --receipt-handle <value> -
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ssm-privesc.md

@@ -134,3 +134,4 @@ aws-codebuild-privesc.md
 
 
 
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sso-and-identitystore-privesc.md

@@ -134,3 +134,4 @@ aws sso-admin   delete-permissions-boundary-from-permission-set --instance-arn <
 
 
 
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-stepfunctions-privesc.md

@@ -255,3 +255,5 @@ aws stepfunctions update-state-machine --state-machine-arn arn:aws:states:us-eas
 
 
 
+
+