Role Chain Juggling - Hacking The Cloud Keep your access by chaining assume-role calls.

What if you could maintain AWS access indefinitely without creating users or keys? Role chain juggling exploits how assume-role refreshes credential expiration. Chain calls to the same role or cycle between roles to keep access alive.

IAM Persistence through Eventual Consistency - Hacking The Cloud Abuse IAM's eventual consistency to maintain persistence against incident response containment.

Can attackers undo your containment actions before they take effect? IAM's eventual consistency creates a 4-second window where deleted creds stay valid. Attackers can detect and remove deny-all policies before propagation completes.

Detect Public Resource Exposure via Session Policy Error Messages - Hacking The Cloud Use session policy denials and verbose IAM error messages to determine if AWS resources have public resource-based policies.

ICYMI: Our latest article covers Daniel Grzelak's research on how AWS error messages can reveal publicly exposed resources, without needing access! We cover how to use them for enumeration and detection.

Apps Script project impersonation / Google Apps Script persistence - Hacking The Cloud Google Workspace Apps Script projects create hidden GCP projects (sys-<...>) that can be impersonated by attackers. This technique enables stealthy persistence (service accounts, hidden compute,…

Can attackers hide GCP projects in plain sight? Apps Script projects create hidden sys-* folders invisible in the console. Attackers can mimic this naming convention to stash service accounts or compute instances where no one looks.

Uncovering agent logging gaps in Copilot Studio | Datadog Security Labs During research, we sometimes encounter scenarios that remind us that it's a good idea to trust but verify. In September 2025, we noticed that certain Microsoft Copilot Studio agent settings did not…

AI agents are becoming identity infrastructure, whether we’re ready or not. While investigating agent controls, the Datadog Security Research Team found that Copilot Studio wasn’t recording certain administrative changes to agents, exposing a potential monitoring blind spot.

Enumerate AWS Account ID from an EC2 Instance - Hacking The Cloud With access to an ec2 instance, you will be able to identify the AWS account it runs in.

Got shell access to an EC2 instance? You can enumerate the AWS account ID using two methods: get-caller-identity if an instance profile exists, or the metadata service at 169.254.169.254. Both reveal the account ID plus useful context like region and instance type.

Unauthenticated Enumeration of Azure Active Directory Email Addresses - Hacking The Cloud Discover how to exploit information disclosure configurations in Azure Active Directory to enumerate valid email addresses.

Got a list of potential corporate emails? You can verify which ones are valid Azure AD accounts without authentication using tools like CredMaster or Quiet Riot. Useful for password spraying or even pivoting to AWS root user testing.

Abusing Overpermissioned AWS Cognito Identity Pools - Hacking The Cloud How to take advantage of misconfigured Amazon Cognito Identity Pools.

What if an attacker could turn a simple Cognito login into full AWS account access? Misconfigured Identity Pools can grant excessive IAM permissions to anyone who authenticates, even anonymous users. Learn how this exploitation chain works.

Introduction to User Data - Hacking The Cloud An introduction to EC2 User Data and how to access it.

EC2 user data scripts often contain hardcoded credentials, despite AWS explicitly warning against it. If you gain access to an instance, check 169.254.169.254/latest/user-... immediately.

Create a Console Session from IAM Credentials - Hacking The Cloud How to use IAM credentials to create an AWS Console session.

Got IAM creds but tired of wrestling with CLI flags? You can spawn an AWS Console session using aws-vault. Temporary creds work directly, long-term creds need sts:GetFederationToken first. Heads up: this is noisy in CloudTrail.

GCP Cloud Workstations Privilege Escalation - Hacking The Cloud Break out of a Cloud Workstations container through an exposed Docker socket, then access project credentials from instance metadata.

ICYMI: A look at how a familiar container escape pattern shows up in GCP Cloud Workstations. We trace a path from a container to service account.

If you’re using Cloud Workstations, this is a useful model to keep in mind.

Get IAM Credentials from a Console Session - Hacking The Cloud Convert access to the AWS Console into IAM credentials.

Got browser cookies but no AWS credentials? CloudShell has an undocumented metadata endpoint on port 1338 that exposes IAM creds. Load the session cookies, hit the endpoint, and you've got temporary credentials for your tools.

Loot Public EBS Snapshots - Hacking The Cloud How to find and take advantage of exposed EBS snapshots.

Tens of thousands of EBS snapshots are publicly exposed right now. Unlike most AWS resources, you can list all public snapshots via the API and filter by account ID. Easy recon, zero detection risk.

Brute Force IAM Permissions - Hacking The Cloud Brute force the IAM permissions of a user or role to see what you have access to.

How do you know what permissions compromised AWS credentials actually have? Brute force them. enumerate-iam tests safe API calls to map your access. Just note: this is loud and will light up CloudTrail.

Call for research: AI and LLM security - Hacking The Cloud Hacking the Cloud is opening the door to AI and LLM security research.

ICYMI: AI workloads are landing in the same cloud accounts we’ve been breaking into (and defending) for years. It's time for Hacking the Cloud to catch up. We're announcing a call for research! Share your AI and LLM sec research with thousands of readers.

Hunting GCP Buckets - Hacking The Cloud How to find valid and invalid GCP Buckets using tools

GCP buckets and AWS S3 buckets are nearly identical under the hood. CloudStorageFinder works for both with minimal changes - just swap the endpoint URL. Here's how to hunt for GCP buckets.

AWS Network Firewall Egress Filtering Bypass - Hacking The Cloud Bypass AWS Network Firewall Egress Filtering using SNI spoofing and Host Header manipulation.

AWS Network Firewall checks SNI and Host headers but never verifies the actual destination IP. Attackers can bypass egress filtering by spoofing legitimate domains while routing traffic to malicious IPs.

Break LLM Workflows with Claude's Refusal Magic String - Hacking The Cloud How Anthropic's refusal test string can be abused to stop streaming responses and create sticky failures.

In case you missed it, did you know Claude models have a "magic string" to test when a model refuses to respond? If that string enters prompt context, it can be abused to break LLM workflows until context is reset.

It's the EICAR test string of the AI age. Details:

Exploiting Misconfigured GitLab OIDC AWS IAM Roles - Hacking The Cloud Discover how to identify and exploit misconfigured AWS IAM roles using GitLab OIDC, with a detailed, step-by-step guide.

Misconfigured GitLab OIDC with AWS IAM roles can lead to unauthorized role assumption. Learn to identify and exploit such vulnerabilities with a step-by-step guide. Stay informed to protect your cloud infrastructure from unauthorized access.

Unauthenticated Enumeration of IAM Users and Roles - Hacking The Cloud Discover how to exploit cross-account behaviors to enumerate IAM users and roles in another AWS account without authentication.

Discover how to enumerate IAM users and roles in AWS without prior access! Through clever techniques like exploiting resource-based policies, you can explore insights across AWS accounts. Harness tools like Quiet Riot for efficient execution. Dive deeper here:

Abusing Misconfigured Role Trust Policies with a Wildcard Principal - Hacking The Cloud How to take advantage of misconfigured role trust policies that have wildcard principals.

Exploring the impact of misconfigured AWS IAM role trust policies. Learn how wildcard Principals in trust policies can open up roles to any AWS account, posing serious security risks. Are your policies airtight? Dive deeper into this cloud security issue with us!

Terraform Enterprise: Attack the Metadata Service - Hacking The Cloud Leverage a default configuration in Terraform Enterprise to steal credentials from the Metadata Service

Discover how a default configuration in Terraform Enterprise can expose sensitive credentials via the Metadata Service. By understanding the nuances of remote execution and Docker in Terraform, you can mitigate potential security risks before they affect your cloud infrastructure.

2025 Hacking the Cloud: Year in Review - Hacking The Cloud An end of year summary for Hacking the Cloud in 2025.

The 2025 Hacking the Cloud: Year in Review is out! We take a look at the growing tide of software supply chain attacks, discuss the most critical cloud vuln discovered to date, and share some stats for the site!

hackingthe.cloud/blog/2025_wr...

Connection Tracking - Hacking The Cloud Abuse security group connection tracking to maintain persistence even when security group rules are changed.

Discover how AWS connection tracking affects security group rules. Once connections are established, they persist even if rules change. Learn how this impacts security, illustrated with EC2 instances and penetration testing scenarios.

CI/CDon't - Hacking The Cloud An AWS/GitLab CICD themed CTF.

Dive into "CI/CDon't", an AWS/GitLab-themed CTF where you can test your security chops on vulnerable infrastructure. Deploy it using Terraform and explore fun, low-difficulty CI/CD challenges. Remember, it's in your AWS account, so handle with care! Check it out:

Bypass GuardDuty Tor Client Findings - Hacking The Cloud Connect to the Tor network from an EC2 instance without alerting GuardDuty.

Learn how to bypass AWS GuardDuty's Tor Client detection on EC2 instances without triggering alerts. By leveraging Tor bridges and using obfs4proxy, you can connect discreetly to the Tor network, maintaining privacy while avoiding unauthorized access warnings. More details here:

IAM Persistence through Eventual Consistency - Hacking The Cloud Abuse IAM's eventual consistency to maintain persistence against incident response containment.

New on @hackingthe.cloud, did you know that attackers can prevent you from kicking them out of your environment in certain situations? Eduard Agavriloae shares his research on how attackers can nullify containment attempts!

hackingthe.cloud/aws/post_exp...

Steal IAM Credentials and Event Data from Lambda - Hacking The Cloud Leverage file read and SSRF vulnerabilities to steam IAM credentials and event data from Lambda.

Lambda's environment variables hold IAM credentials that attackers can target via file read and SSRF vulnerabilities. They can also extract event data using SSRF exploits. This blog explores practical techniques for exploiting these vulnerabilities in Lambda functions.

Discover secrets in public AMIs - Hacking The Cloud How to find public AMIs and get stored secrets.

Public AMIs can reveal AWS secrets! If you have an account ID, you can use the AWS API to find these AMIs and launch instances to look for sensitive data. Manual and automated scanning can help find credentials, but remember: curiosity must come with a conscience.

GCP Goat - Hacking The Cloud GCP Goat is the Vulnerable application for learning the GCP Security

Explore Google Cloud Security with GCP-Goat! This tool offers hands-on scenarios for testing vulnerabilities in GCP services like Compute Engine, SQL Instances, and GKE. Enhance your security skills by diving into realistic attack simulations. Check it out!