Title Page

Copyright and Credits

About Packt

Contributors

Preface

1. Setting Up a Pentesting Lab on AWS FREE CHAPTER

• Technical requirements
• Setting up a vulnerable Ubuntu instance
• Setting up a vulnerable Windows instance
• Configuring security groups within the lab
• Summary
• Further reading

2. Setting Up a Kali PentestBox on the Cloud

• Technical requirements
• Setting up Kali Linux on AWS EC2
• Configuring OpenSSH for remote SSH access
• Setting up Guacamole for remote access
• Summary
• Questions
• Further reading

3. Exploitation on the Cloud using Kali Linux

• Technical requirements
• Configuring and running Nessus
• Exploiting a vulnerable Linux VM
• Exploiting a vulnerable Windows VM
• Summary
• Questions
• Further reading

4. Setting Up Your First EC2 Instances

• Technical requirements
• Setting Up Ubuntu on AWS EC2
• Configuring VPC settings
• Storage types that are used in EC2 instances
• Configuring firewall settings
• Configuring EC2 authentication
• Summary
• Further reading

5. Penetration Testing of EC2 Instances using Kali Linux

• Technical requirements
• Installing a vulnerable service on Windows
• Scanning and reconnaissance using Nmap
• Identifying and fingerprinting open ports and services using Nmap
• Performing an automated vulnerability assessment using Nexpose
• Using Metasploit for automated exploitation
• Using Meterpreter for privilege escalation, pivoting, and persistence
• Summary
• Further reading

6. Elastic Block Stores and Snapshots - Retrieving Deleted Data

• Technical requirements
• Creating, attaching, and detaching new EBS volumes from EC2 instances
• Extracting deleted data from EBS volumes
• Full disk encryption on EBS volumes
• Summary
• Further reading

7. Reconnaissance - Identifying Vulnerable S3 Buckets

• Setting up your first S3 bucket
• S3 permissions and the access API
• Creating a vulnerable S3 bucket
• Summary
• Further reading

8. Exploiting Permissive S3 Buckets for Fun and Profit

• Extracting sensitive data from exposed S3 buckets
• Injecting malicious code into S3 buckets
• Backdooring S3 buckets for persistent access
• Summary
• Further reading

9. Identity Access Management on AWS

• Creating IAM users, groups, roles, and associated privileges
• Limit API actions and accessible resources with IAM policies
• Using IAM access keys
• Signing AWS API requests manually
• Summary

10. Privilege Escalation of AWS Accounts Using Stolen Keys, Boto3, and Pacu

• The importance of permissions enumeration
• Using the boto3 library for reconnaissance
• Dumping all the account information
• Permission enumeration with compromised AWS keys
• Privilege escalation and gathering credentials using Pacu
• Summary

11. Using Boto3 and Pacu to Maintain AWS Persistence

• Backdooring users
• Backdooring role trust relationships
• Backdooring EC2 Security Groups
• Using Lambda functions as persistent watchdogs
• Summary

12. Security and Pentesting of AWS Lambda

• Setting up a vulnerable Lambda function
• Attacking Lambda functions with read access
• Attacking Lambda functions with read and write access
• Pivoting into Virtual Private Clouds
• Summary

13. Pentesting and Securing AWS RDS

• Technical requirements
• Setting up a vulnerable RDS instance
• Connecting an RDS instance to WordPress on EC2
• Identifying and enumerating exposed RDS instances using Nmap
• Exploitation and data extraction from a vulnerable RDS instance
• Summary
• Further reading

14. Targeting Other Services

• Route 53
• Simple Email Service (SES)
• Attacking all of CloudFormation
• Elastic Container Registry (ECR)
• Summary

15. Pentesting CloudTrail

• More about CloudTrail
• Setup, best practices, and auditing
• Reconnaissance
• Bypassing logging
• Disrupting trails
• Summary

16. GuardDuty

• An introduction to GuardDuty and its findings
• Alerting about and reacting to GuardDuty findings
• Bypassing GuardDuty
• Summary

17. Using Scout Suite for AWS Security Auditing

• Technical requirements
• Setting up a vulnerable AWS infrastructure
• Configuring and running Scout Suite
• Parsing the results of a Scout Suite scan
• Using Scout Suite's rules
• Summary

18. Using Pacu for AWS Pentesting

• Pacu history
• Getting started with Pacu
• Pacu commands
• Creating a new module
• An introduction to PacuProxy
• Summary

19. Putting it All Together - Real - World AWS Pentesting

• Pentest kickoff
• Unauthenticated reconnaissance
• Authenticated reconnaissance plus permissions enumeration
• Privilege escalation
• Persistence
• Post-exploitation
• Auditing for compliance and best practices
• Summary

1. Other Books You May Enjoy

• Leave a review - let other readers know what you think

Index