abusethe.cloud reusable cloud abuse techniques

AWS attack techniques

abusethe.cloud

Cloud attacks, explained as reusable ideas.

See what the attacker does, why AWS lets it work, and where the same idea appears across services.

Browse by objective

Cloud attack techniques

8 entries

Credential Access

01

Workload role credential exfiltration

Run code inside an AWS workload, collect the temporary credentials AWS gives it, and send those credentials somewhere else for reuse.

  • Amazon EC2
  • Amazon ECS
  • AWS Lambda
  • AWS Glue
  • Amazon SageMaker AI

Persistence

02

Private network connections after access revocation

Create a private network path while cross-account access is valid, then keep using the existing connection after the owner revokes the permission or share that allowed it.

  • AWS PrivateLink
  • AWS Resource Access Manager
  • Amazon VPC
  • AWS Transit Gateway

Self-healing IAM privileges

Use scheduled AWS automation to restore a privileged IAM user or policy attachment after responders remove it.

  • AWS Lambda
  • Amazon EventBridge
  • AWS Step Functions
  • AWS Systems Manager

Exfiltration

02

Passive cross-account traffic collection

Collect workload packets or flow metadata from the VPC network layer without installing capture software in the guest operating system.

  • Amazon VPC Traffic Mirroring
  • AWS Gateway Load Balancer
  • Amazon VPC Flow Logs
  • AWS Resource Access Manager

S3 exfiltration through delegated access

Add an external S3 reader through Access Grants or an access point policy after the bucket has delegated part of its authorization.

  • Amazon S3 Access Grants
  • Amazon S3 Access Points
  • Amazon S3 Multi-Region Access Points

Stealth

01

Service execution-role proxy

Submit attacker-controlled code to a managed AWS compute service, then make API calls through the service role selected for that workload.

  • Amazon SageMaker AI
  • AWS Glue
  • AWS CodeBuild

Impact

02

Cross-account VPC DNS hijacking

Associate a target VPC with DNS resources owned by another account, then change its private answers from the source account.

  • Amazon Route 53
  • Amazon Route 53 Profiles
  • Amazon Route 53 Resolver
  • AWS Resource Access Manager

S3 object lockout with SSE-C

Copy S3 objects onto their existing keys with an encryption key that S3 does not retain, making the current objects unreadable without that key.

  • Amazon S3