Hands-on AWS penetration testing with Kali Linux : set up a virtual lab and pentest major AWS services, including EC2, S3, Lambda, and CloudFormation

Description

Table of Contents Preface Section 1: Section 1: Kali Linux on AWS Chapter 1: Setting Up a Pentesting Lab on AWS Technical requirements Setting up a vulnerable Ubuntu instance Provisioning an Ubuntu EC2 instance Installing a vulnerable service on Ubuntu Setting up a vulnerable Windows instance Provisioning a vulnerable Windows server instance Configuring a vulnerable web application on Windows Configuring security groups within the lab Configuring security groups Summary Further reading Chapter 2: Setting Up a Kali PentestBox on the Cloud Technical requirements Setting up Kali Linux on AWS EC2 The Kali Linux AMI Configuring the Kali Linux instance Configuring OpenSSH for remote SSH access Setting root and user passwords Enabling root and password authentication on SSH Setting up Guacamole for remote access Hardening and installing prerequisites Configuring Guacamole for SSH and RDP access Summary Questions Further reading Chapter 3: Exploitation on the Cloud using Kali Linux Technical requirements Configuring and running Nessus Installing Nessus on Kali Configuring Nessus Performing the first Nessus scan Exploiting a vulnerable Linux VM Understanding the Nessus scan for Linux Exploitation on Linux Exploiting a vulnerable Windows VM Understanding the Nessus scan for Windows Exploitation on Windows Summary Questions Further reading Section 2: Section 2: Pentesting AWS Elastic Compute Cloud Configuring and Securing Chapter 4: Setting Up Your First EC2 Instances Technical requirements Setting Up Ubuntu on AWS EC 3The Ubuntu AMI Configuring VPC settings Storage types that are used in EC2 instances Configuring firewall settings Configuring EC2 authentication Summary Further reading Chapter 5: Penetration Testing of EC2 Instances using Kali Linux Technical requirements Installing a vulnerable service on Windows Setting up a target machine behind the vulnerable Jenkins machine Setting up Nexpose vulnerability scanner on our Kali machine Scanning and reconnaissance using Nmap Identifying and fingerprinting open ports and services using Nmap Performing an automated vulnerability assessment using Nexpose Using Metasploit for automated exploitation Using Meterpreter for privilege escalation, pivoting, and persistence Summary Further reading Chapter 6: Elastic Block Stores and Snapshots - Retrieving Deleted Data Technical requirements EBS volume types and encryption Creating, attaching, and detaching new EBS volumes from EC2 instances Extracting deleted data from EBS volumes Full disk encryption on EBS volumes Creating an encrypted volume Attaching and mounting an encrypted volume Retrieving data from an encrypted volume Summary Further reading Section 3: Section 3: Pentesting AWS Simple Storage Service Configuring and Securing Chapter 7: Reconnaissance - Identifying Vulnerable S3 Buckets Setting up your first S3 bucket S3 permissions and the access API ACPs/ACLs Bucket policies IAM user policies Access policies Creating a vulnerable S3 bucket Summary Further reading Chapter 8: Exploiting Permissive S3 Buckets for Fun and Profit Extracting sensitive data from exposed S3 buckets Injecting malicious code into S3 buckets Backdooring S3 buckets for persistent access Summary Further reading Section 4: Section 4: AWS Identity Access Management Configuring and Securing Chapter 9: Identity Access Management on AWS Creating IAM users, groups, roles, and associated privileges Limit API actions and accessible resources with IAM policies IAM policy structure IAM policy purposes and usage Using IAM access keys Signing AWS API requests manually Summary Chapter 10: Privilege Escalation of AWS Accounts Using Stolen Keys, Boto3, and Pacu The importance of permissions enumeration Using the boto3 library for reconnaissance Our first Boto3 enumeration script Saving the data Adding some S3 enumeration Dumping all the account information A new script – IAM enumeration Saving the data (again) Permission enumeration with compromised AWS keys Determining our level of access Analysing policies attached to our user An alternative method Privilege escalation and gathering credentials using Pacu Pacu – an open source AWS exploitation toolkit Kali Linux detection bypass The Pacu CLI From enumeration to privilege escalation Using our new administrator privileges Summary Chapter 11: Using Boto3 and Pacu to Maintain AWS Persistence Backdooring users Multiple IAM user access keys Do it with Pacu Backdooring role trust relationships IAM role trust policies Finding a suitable target role Adding our backdoor access Confirming our access Automating it with Pacu Backdooring EC2 Security Groups Using Lambda functions as persistent watchdogs Automating credential exfiltration with Lambda Using Pacu for the deployment of our backdoor Other Lambda Pacu modules Summary Section 5: Section 5: Penetration Testing on Other AWS Services Chapter 12: Security and Pentesting of AWS Lambda Setting up a vulnerable Lambda function Attacking Lambda functions with read access Attacking Lambda functions with read and write access Privilege escalation Data exfiltration Persistence Staying stealthy Pivoting into Virtual Private Clouds Summary Chapter 13: Pentesting and Securing AWS RDS Technical requirements Setting up a vulnerable RDS instance Connecting an RDS instance to WordPress on EC 6Identifying and enumerating exposed RDS instances using Nmap Exploitation and data extraction from a vulnerable RDS instance Summary Further reading Chapter 14: Targeting Other Services Route 97Hosted zones Domains Resolvers Simple Email Service (SES) Phishing Other attacks Attacking all of CloudFormation Parameters Output values Termination protection Deleted stacks Exports Templates Passed roles Bonus – discovering the values of NoEcho parameters Elastic Container Registry (ECR) Summary Section 6: Section 6: Attacking AWS Logging and Security Services Chapter 15: Pentesting CloudTrail More about CloudTrail Setup, best practices, and auditing Setup Auditing Reconnaissance Bypassing logging Unsupported CloudTrail services for attackers and defenders Bypassing logging through cross-account methods Enumerating users Enumerating roles Disrupting trails Turning off logging Deleting trails/S3 buckets Minifying trails Problems with disruption (and some partial solutions) Summary Chapter 16: GuardDuty An introduction to GuardDuty and its findings Alerting about and reacting to GuardDuty findings Bypassing GuardDuty Bypassing everything with force Bypassing everything with IP whitelisting Bypassing EC2 instance credential exfiltration alerts Bypassing operating system (PenTest) alerts Other simple bypasses Cryptocurrency Behavior ResourceConsumption Stealth Trojan Others Summary Section 7: Section 7: Leveraging AWS Pentesting Tools for Real-World Attacks Chapter 17: Using Scout Suite for AWS Security Auditing Technical requirements Setting up a vulnerable AWS infrastructure A misconfigured EC2 instance Creating a vulnerable S3 instance Configuring and running Scout Suite Setting up the tool Running Scout Suite Parsing the results of a Scout Suite scan Using Scout Suite's rules Summary Chapter 18: Using Pacu for AWS Pentesting Pacu history Getting started with Pacu Pacu commands list/ls search [[cat]egory] help help whoami data services data |proxy regions update_regions set_regions [...] run/exec set_keys swap_keys import_keys |--all exit/quit/Ctrl + C aws proxy Creating a new module The API session/get_active_session get_proxy_settings print/input key_info fetch_data get_regions install_dependencies get_boto3_client/get_boto3_resource Module structure and implementation An introduction to PacuProxy Summary Chapter 19: Putting it All Together - Real - World AWS Pentesting Pentest kickoff Scoping AWS pentesting rules and guidelines Credentials and client expectations Setup Unauthenticated reconnaissance Authenticated reconnaissance plus permissions enumeration Privilege escalation Persistence Post-exploitation EC2 exploitation Code review and analysis in Lambda Getting past authentication in RDS The authenticated side of S3 Auditing for compliance and best practices Summary Other Books You May Enjoy Index