A Thrilling Dive into Cloud Penetration Testing

Hello everyone, Today I am back with Cloud Penetration learning resources which I have followed to learn. By following which you can also learn in a structure way.

Why should you learn it?
Companies are shifting from on premises to the cloud. So for which the demand of Cloud Penetration Tester is increasing. And if you’ve been in application security for a long time, you should move to cloud security.
If you know application Penetration Testing and cloud penetration testing, you can expect a good package at any company. So Let’s get started?

Cloud penetration testing is slightly different in that you read each provider’s rules before performing penetration testing and then start penetration testing. These are the three most popular providers (AWS / AZURE/ GCP)

For Learning AWS:
1. Our first step is to familiar with AWS CLI & Create a Free Tier Account Amazon Web Services and Playing with IAM & how each service works.

2. Deploy CloudGoat & familiar yourself with PACU framework Just think It’s the Metasploit framework for the Cloud.

3. After create an account you should set IAM roles and start solving CloudGoat Labs piping with your AWS account.

4. Alternatively you can deploy AWSGoat from INE , basically INE has given this vulnerable application to OWASP for free. Because they didn’t have any cloud applications at that time.

5. They have more vulnerable applications that you can deploy for free and learn cloud penetration testing if you have a free tier account. ( GCPGoat, AzureGoat) And every provider gives free account for 1 year to understand their services and how cloud works.

6. I highly recommend you read this book alongside solving labs Cloud Penetration Testing for Red Teamers: Learn how to effectively pentest AWS, Azure, and GCP applications Author has explained the 3 architectures very simply in this book including tools and every policies, Everything you need to know about cloud penetration testing. I bought the book 3 days after its release date. And I have read the entire book properly. Although it is available on the internet for free, someone has leaked it.

For AZURE:

For GCP:

7.Each repo contains a write-up of its lab solving.

Additionally, I’m providing two more links (The first links includes the Roadmap to Complete Cloud Security)

A few tips from my side:

90% of the cloud bugs you have learned on the web before, so it won’t take you long to learn cloud penetration testing.If you are doing WEB/API pen-testing on Bug Bounty you should learn cloud. Because you can easily get the raw source code. if you can compromise the cloud. Because cloud says just give me the source code and I will arrange & deploy everything for you in just one click. In simple terms a company’s cloud compromised means the whole company is compromised.See this picture, then you will understand more easily. think AWS = JAVA, Kotlin = GCP, Azure = Python. Every programming language like variable, array, data types works same just only syntax changes of each language. In cloud the services works the same way, provider has given their own fancy names.

4. Many cloud penetration testers end up as cloud security engineers, requiring you to pass exams and obtain certifications like : AWS Certified Solutions Architect / Professional Cloud Security Engineer Certification by Google. In simple terms you are responsible for deploying the application securely on cloud.

5. By following this roadmap you’re good fit for GCPN certification without training with just buy the voucher instead.

Happy Hacking :)