☁️ Head in the Clouds | Cloud Hacking with panawesome
Source: YouTube · Hack The Box · published Jan 17, 2023 · 20:44
This workshop demonstrates how to exploit a Hystrix vulnerability to access AWS Instance Metadata Service and extract credentials to compromise an S3 bucket 0:00-0:11.
Key Takeaways:
• AWS S3 buckets often have security issues due to misconfigurations rather than the service itself 1:20-1:51.
• AWS uses IAM with users, groups, and roles to manage permissions through policies 2:25-3:12.
• The IMDS at IP 169.254.169.254 can expose sensitive instance data when accessible 4:04-4:56.
• Hystrix vulnerability allows proxy endpoint access to internal services like IMDS 7:48-8:11.
• Extracted AWS credentials can be used with AWS CLI to access S3 buckets 12:38-16:06.
Cloud security depends on securing all components, as the vulnerability was in Hystrix rather than the S3 bucket itself 19:56-20:18.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cloud Security. Commonly maps to: Security Architecture and Engineering, Communication and Network Security. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
hi everyone this is Panos from hack the box and welcome to the University cpf of 2022 I'm here to do a workshop with you and it's going to be focused on cloud hacking last year we had a lot of skilled players and it seemed that a lot of them had problems with Cloud challenges so we are going to show one that it was used in last year's finals and see how we can use the same techniques that we use for example in Cloud challenges or just regular machines to solve the cloud channels so without wasting any more time let's begin with the least interesting part it's about me who am I so my name is I studied computer science I had my bachelors and my master's degree from Dalton's university university of economics and business and I was a CDF player for a while me and my team were from the first p…