Overview

Whether you are an Architect, Developer, Pen Tester, Security or DevOps Engineer, or anyone with a need to understand and manage cloud security vulnerabilities, specifically in a Cloud and Cloud Native environment, understanding relevant hacking techniques, and knowing how to protect yourself from them is critical. Offensive Cloud Hacking, covers both the theory as well as the practical through a number of modern techniques that may be used to compromise various Cloud services and infrastructure.

Learners will be provided with numerous cloud security scripts and tools (some public and some NotSoPublic) will also be provided during the training, along with the student handouts. The course also comes with detailed answer sheets. That is a step by step walkthrough of how every exercise within the class needs to be solved. These answer sheets are also provided to students at the end of the class.

Who Should take this course;

Cloud Administrators, Developers, Solutions Architects, DevOps Engineers, SOC Analysts, Penetration Testers, Network Engineers, security professionals and enthusiasts and anyone who wants to take their offensive cloud hacking skills to the next level.

Prerequisites

Prior pen test / security experience is not a strict requirement, however, some knowledge of Cloud Services and familiarity with common command-line syntax will be beneficial.

Learning Outcomes

Delegates will gain knowledge of offensive cloud security hacking tools and techniques, including attacking, exploiting a variety of Cloud services and infrastructure. You will play the part of the hacker, compromising serverless apps, cloud machines, storage and database services, dormant assets and resources. Including the opportunity to learn privilege escalation and pivoting techniques specific to cloud environments.

Course Outline

OFFENSIVE CLOUD HACKING

INTRODUCTION TO CLOUD COMPUTING

  • Introduction to cloud and why cloud security matters
  • Comparison with conventional security models
  • Shared responsibility model
  • Legalities around Cloud Pentesting

ATTACKING CLOUD SERVICES

ENUMERATION OF CLOUDENVIRONMENTS

  • DNS based enumeration
  • OSINT techniques for cloud-based asset

GAINING ENTRY VIA EXPOSED SERVICES

  • Serverless based attacks (AWS Lambda / Azure & Google functions)
  • Web application Attacks
  • Exposed Service Ports

ATTACKING SPECIFIC CLOUD SERVICES

  • Storage Attacks
  • Azure AD Attacks
  • Containers and Kubernetes Clusters
  • IAM Misconfiguration Attacks
  • Roles and permissions-based attacks
  • Attacking Cognito misconfigurations

POST- EXPLOITATION

  • Persistence in Cloud
  • Post exploit enumeration
  • Snapshot access
  • Backdooring the account