AWS Penetration Testing: Beginner's guide to hacking AWS with tools such as Kali Linux, Metasploit, and Nmap

✍ Scribed by Jonathan Helmus

• Publisher: Packt Publishing
• Year: 2020
• Tongue: English
• Leaves: 330
• Category: Library

✦ Synopsis

Get to grips with security assessment, vulnerability exploitation, workload security, and encryption with this guide to ethical hacking and learn to secure your AWS environment

Key Features

• Perform cybersecurity events such as red or blue team activities and functional testing
• Gain an overview and understanding of AWS penetration testing and security
• Make the most of your AWS cloud infrastructure by learning about AWS fundamentals and exploring pentesting best practices

Book Description

Cloud security has always been treated as the highest priority by AWS while designing a robust cloud infrastructure. AWS has now extended its support to allow users and security experts to perform penetration tests on its environment. This has not only revealed a number of loopholes and brought vulnerable points in their existing system to the fore, but has also opened up opportunities for organizations to build a secure cloud environment. This book teaches you how to perform penetration tests in a controlled AWS environment.

You'll begin by performing security assessments of major AWS resources such as Amazon EC2 instances, Amazon S3, Amazon API Gateway, and AWS Lambda. Throughout the course of this book, you'll also learn about specific tests such as exploiting applications, testing permissions flaws, and discovering weak policies. Moving on, you'll discover how to establish private-cloud access through backdoor Lambda functions. As you advance, you'll explore the no-go areas where users can’t make changes due to vendor restrictions and find out how you can avoid being flagged to AWS in these cases. Finally, this book will take you through tips and tricks for securing your cloud environment in a professional way.

By the end of this penetration testing book, you'll have become well-versed in a variety of ethical hacking techniques for securing your AWS environment against modern cyber threats.

What you will learn

• Set up your AWS account and get well-versed in various pentesting services
• Delve into a variety of cloud pentesting tools and methodologies
• Discover how to exploit vulnerabilities in both AWS and applications
• Understand the legality of pentesting and learn how to stay in scope
• Explore cloud pentesting best practices, tips, and tricks
• Become competent at using tools such as Kali Linux, Metasploit, and Nmap
• Get to grips with post-exploitation procedures and find out how to write pentesting reports

Who this book is for

If you are a network engineer, system administrator, or system operator looking to secure your AWS environment against external cyberattacks, then this book is for you. Ethical hackers, penetration testers, and security consultants who want to enhance their cloud security skills will also find this book useful. No prior experience in penetration testing is required; however, some understanding of cloud computing or AWS cloud is recommended.

Table of Contents

1. Building Your AWS Environment
2. Pentesting and Ethical Hacking
3. Exploring Pentesting and AWS
4. Exploiting S3 Buckets
5. Understanding Vulnerable RDS Services
6. Setting Up and Pentesting AWS Aurora RDS
7. Assessing and Pentesting Lambda Services
8. Assessing AWS API Gateway
9. Real-Life Pentesting with Metasploit and More!
10. Pentesting Best Practices
11. Staying Out of Trouble
12. Other Projects with AWS

✦ Table of Contents

Cover
Title Page
Copyright and Credits
About Packt
Contributors
Table of Contents
Preface
Section 1: Setting Up AWS and Pentesting Environments
Chapter 1: Building Your AWS Environment
Technical requirements
Exploring Amazon Web Services (AWS)
AWS security and penetration testing
Understanding our testing environment
Configuring your environment
Setting up an account
Setting up EC2 instances
Setting up an EC2 instance with CentOS
Setting up a Windows host
Attacker setup – setting up a Kali instance
Connecting with PuTTY
Exploring vulnerable services
Discovering vulnerable services
Creating vulnerable services
Attacking vulnerabilities
Exploring Metasploit
The AWS Command Line Interface (CLI)
Installing the AWS CLI
Exploring basic AWS CLI commands
Summary
Further reading
Chapter 2: Pentesting and Ethical Hacking
Technical requirements
What is penetration testing?
Finding critical issues before the bad guys do
Pentesting methodology
Types of pentesting
Advantages and disadvantages
Kali Linux
Setting up a Linux image
Exploring essential Linux commands
NMAP
AWS Inspector
Metasploit
Scripting
Operating systems
Linux/Unix
Linux file permissions
sudo
Windows
GUI
Summary
Further reading
Section 2: Pentesting the Cloud – Exploiting AWS
Chapter 3: Exploring Pentesting and AWS
Technical requirements
Exploring reconnaissance
Driving enumeration for recon
Harvesting email addresses
The WHOIS command
Netcraft
Enumerating and understanding AWS services
S3 buckets and discovering open buckets with web apps
Lambda
EC2 instances
Scanning and examining targets for reconnaissance
Metasploit
Nmap
LambdaGuard
S3 scanning
Knowing the attacker
Creating attack paths
Organic attack paths
Goal-based attack paths
AWS attack paths
Pentesting attack paths
Red teaming for businesses
Diving into the attacker mindset
Discovering SSH keys
How the keys work
Good hygiene
Scanning and connecting to AWS
Scanning with Nmap
Starting Metasploit
TCP scanning with Metasploit
ACK scanning with Metasploit
RDP scanning with Metasploit
Connecting with Kali
Connecting with Windows
Learning from experience
Summary
Further reading
Chapter 4: Exploiting S3 Buckets
Technical requirements
AWS Regions and Availability Zones
Availability Zones
Connecting and manipulating S3 buckets
Understanding S3 buckets
Using S3 buckets
S3 buckets
Quick detour – making IAM users
Copying and uploading to S3
Bucket policies and ACLs
Public bucket policies
Understanding policy attributes
Writing bucket policies for policy bypassing
Public buckets
Bucket misconfigurations
Scripts to find private buckets
Python scripting
Bash scripting
Goal-based pentesting scenarios
Discovering buckets with Grayhat Warfare
S3 Burp Suite extensions
Creating a local S3 lab
Summary
Further reading
Chapter 5: Understanding Vulnerable RDS Services
Technical requirements
Understanding RDS
Advantages of using RDS
MySQL
Aurora
Setting up RDS (MySQL)
Adding a rule to the security group
Testing the connection
Scanning RDS
Understanding basic SQL syntax
Database maneuvering and exploration
Dumping hashes with Metasploit
Creating RDS databases
Understanding misconfigurations
Weak passwords
Unpatched databases
Learning about injection points
What is an injection?
How does it work?
Why is it an issue?
Summary
Further reading
Chapter 6: Setting Up and Pentesting AWS Aurora RDS
Technical requirements
Understanding and setting up the Aurora RDS
Setting up Aurora
White box/functional pentesting Aurora
Recon – scanning for public access
Enumerating the username and password
Setting up a lab for SQLi
Configuring Juice Shop autostart
Fun with SQLi
Bypassing the admin login
Logging in as another user
Preventing SQLi
Avoiding DoS
Infrastructure-layer attacks
Application-layer attacks
Protection against DDoS in AWS
Summary
Further reading
Chapter 7: Assessing and Pentesting Lambda Services
Technical requirements
Understanding and setting up a Lambda service
Creating a Lambda function
Digging into Lambda
Creating a Lambda function that is compatible with S3
Understanding misconfigurations
Popping reverse shells with Lambda
The coolness of reverse shells
The ethical hacking game plan
Invoking with AWS CLI
Having fun with Metasploit and Lambda
Summary
Further reading
Chapter 8: Assessing AWS API Gateway
Technical requirements
Exploring and configuring AWS APIs
RESTful APIs
WebSocket APIs
An overview of API maps
Creating our first API with AWS
Getting started with Burp Suite
Configuring Burp Suite
Inspecting traffic with Burp Suite
Deploying the API gateway
Getting practical with intercepting API calls
Manipulating API calls
Fun with altering HTTP methods
Summary
Further reading
Chapter 9: Real-Life Pentesting with Metasploit and More!
Technical requirements
Real pentesting with Metasploit
What is functional testing?
In the dark with black-box testing
The pentest pregame
Renaming our VPC for clarity
Updating Metasploit
Targeting WordPress for exploitation
The scenario - gaining unauthorized access
Setting the target with Lightsail
Enumerating the target
Phishing for credentials
Gaining access to WordPress
Exploiting and getting a reverse shell
Discussing the issues
Targeting vulnerable service applications
The scenario – discovering and attacking any low-hanging fruit
Setting up the target with community AMIs
Scanning for open ports
Information gathering for vulnerable services
Using Metasploit for total system takeover
Post exploitation and weakening additional services
Reporting the vulnerabilities
Exploring AWS Metasploit modules
Stealing user credentials
Discovering EC2 instances in our unknown environment
Enumerating S3 buckets with Metasploit
Summary
Further reading
Section 3: Lessons Learned – Report Writing, Staying within Scope, and Continued Learning
Chapter 10: Pentesting Best Practices
Technical requirements
Pentesting methodology for AWS
Reconnaissance
Exploitation
Post-exploitation
Reporting
Knowing your pentest and the unknowns of AWS pentesting
Obtaining AWS credentials
Owners of resources
Credentials to applications 
Revealing private and public networks
Pre-conditioning for the pentest
Team member assignments
Documentation preparation
Contact list
Avoiding communication breakdown
Daily start and stop emails
Making use of meetings
Answering questions short and simple
Achieving security and not obscurity
Security through obscurity
Avoiding obscurity with S3 buckets
Post-pentest – after the pentest
Post-pentest meeting
Reporting
Six-month follow-up
Summary
Further reading
Chapter 11: Staying Out of Trouble
Prohibited activities
Exhausting services via DoS
Understanding flooding
Avoiding legal issues 
Get-out-of-jail-free card
Potential damage 
Understanding the data classifications 
Stress testing
Why stress test?
Authorized stress testing
Summary
Further reading
Chapter 12: Other Projects with AWS
Technical requirements
Understanding the MITRE ATT&CK framework
Understanding TTPs with AWS matrixes
Discovering MITRE ATT&CK Navigator
Taking the bait with phishing
Executing phishing with AWS
Summary
Further reading
Other Books You May Enjoy
Index