Cloud Hacking w/ Nick Copi (Ep. 200)

This episode of Critical Thinking features Turbo discussing cloud hacking methodology, from client-side dashboard bugs to data plane-to-control plane pivots, with practical examples of command injection, confused deputy attacks, and S3 bucket abuse 3:15.

Key Takeaways:
• Turbo describes a command injection bug in a hardened cloud service's custom glue code: a GET route passed a query parameter into a concatenated CLI command, allowing one-click RCE on a victim's instance via a link, then stealing their over-scoped cloud identity for full write access 5:24-6:15. He found it because prior research taught him where custom code lives on such deployments 7:30-7:52.
• Cloud hacking starts with understanding the shared responsibility model and service architecture—reading docs, deploying instances, and reasoning about what compute must exist behind the dashboard 18:21-19:30.
• The core strategy is working "inside out": shell your own data plane instance, inspect managed identities and binaries on the box, then test whether those credentials can list or access other tenants' resources—inverting the control plane's trust in the data plane 39:28, 48:52-51:05.
• Rich syncs like database connectors (JDBC-style config strings) are prime targets—malicious configs can yield code execution or file disclosure, essentially "reverse SQL injection" 41:14-42:17.
• Confused deputy bugs arise in multi-user tenant setups when low-privilege users can create jobs that pass through higher-privilege roles—auditable via raw IAM permission JSON in the console 1:03:48-1:05:52.
• For S3-style buckets, Turbo highlights signed-URL query parameter tricks (e.g., overriding content-type on anonymous-access objects to turn uploaded PNGs into text/html XSS), and notes postMessage trust chains across tiered domains as gadget opportunities 1:13:04-1:14:04, 35:47-36:26.
• AI changes the economics: rather than brute-forcing targets with massive token budgets, understanding the threat model lets you point an "AI battering ram" at the specific weak point for far better results 10:54-11:48, 40:41-40:52.

The episode closes with the hosts agreeing that "real cloud" hacking rewards deep threat modeling over naive scanning, and teasing the show's community resources at ctbb.show 1:19:03-1:19:43.

Sources:

• 5:24-6:15 Command injection bug in cloud service custom code leading to RCE and credential theft
• 7:30-7:52 Why Turbo found it: prior research on similar targets
• 10:54-11:48 AI's impact on bug hunting economics and scoping AI efforts
• 18:21-19:30 Understanding cloud service architecture and threat models