☁️ AWSGoat : A Damn Vulnerable AWS Infrastructure.
• Заведомо уязвимая облачная инфраструктура для проверки разных техник взлома AWS.
• https://github.com/ine-labs/AWSGoat
#AWS
• Заведомо уязвимая облачная инфраструктура для проверки разных техник взлома AWS.
• https://github.com/ine-labs/AWSGoat
#AWS
GitHub
GitHub - ine-labs/AWSGoat: AWSGoat : A Damn Vulnerable AWS Infrastructure
AWSGoat : A Damn Vulnerable AWS Infrastructure. Contribute to ine-labs/AWSGoat development by creating an account on GitHub.
• В этой статье описаны актуальные методы атак на AWS, которые используют злоумышленники.
• Insufficient Security Configuration;
• Insecure Data storage;
• Insecure Deployment and Configuration Management;
• Backdoor Lambda Function Through Resource-Based Policy;
• Overwrite Lambda Function Code;
• Create an IAM Roles Anywhere trust anchor;
• Exfiltrate RDS Snapshot by Sharing;
• Backdoor an S3 Bucket via its Bucket Policy;
• Exfiltrate an AMI by Sharing It;
• Exfiltrate EBS Snapshot by Sharing It;
• Execute Discovery Commands on an EC2 Instance;
• Download EC2 Instance User Data;
• Execute Commands on EC2 Instance via User Data;
• Noncompliant Code;
• Compliant Code;
• Retrieve EC2 Password Data;
• Noncompliant Code;
• Compliant Code;
• Insecure Deployment and Configuration Management;
• Local Filesystem;
• AWS Security Token;
• AWS Security Token Permission enumeration;
• ec2:CreateSnapshot and ec2:DescribeVolumes;
• Amazon Cognito;
• References.
#devsecops #aws
Please open Telegram to view this post
VIEW IN TELEGRAM
• Awesome Cloud Security Labs - объемный набор бесплатных лаб для самостоятельного изучения безопасности облачных сред и технологий:
➡ AWS;
➡ Azure;
➡ GCP;
➡ Kubernetes;
➡ Container;
➡ Terraform;
➡ Research Labs;
➡ CI/CD.
➡ https://github.com/iknowjason/Awesome-CloudSec-Labs
#Cloud #ИБ
#Cloud #ИБ
Please open Telegram to view this post
VIEW IN TELEGRAM
GitHub
GitHub - iknowjason/Awesome-CloudSec-Labs: Awesome free cloud native security learning labs. Includes CTF, self-hosted workshops…
Awesome free cloud native security learning labs. Includes CTF, self-hosted workshops, guided vulnerability labs, and research labs. - GitHub - iknowjason/Awesome-CloudSec-Labs: Awesome free clou...