LoopyLuci Cloud Penetration Testing
Testing cloud infrastructure security — from AWS/Azure/GCP IAM enumeration through S3 bucket to privilege escalation, metadata service, and container escape.
When to Use
- Assessing cloud infrastructure security posture
- Testing cloud IAM policies for privilege escalation
- Auditing cloud storage (S3, Blob, GCS) configuration
- Cloud metadata service exploitation
- Container escape within cloud environments
Cloud Attack Techniques
CLOUD_ATTACKS = {
'iam_enumeration': 'Enumerate IAM permissions, users, roles, policies via CLI or API',
's3_bucket': 'List bucket contents, upload/download, ACL misconfiguration, public access',
'metadata_service': 'Query http://169.254.169.254/latest/meta-data/ for instance creds',
'lambda_injection': 'Exploit event injection into Lambda functions for privilege escalation',
'cloudtrail_logs': 'Disable or modify logging to cover tracks (cloudtrail:StopLogging)',
'kms_key_abuse': 'Decrypt data using misconfigured KMS key policies',
'privilege_escalation': 'iam:PassRole, iam:CreatePolicyVersion, ec2:RunInstances with admin role',
}
# AWS metadata service attacks
AWS_METADATA_QUERY = [
"curl http://169.254.169.254/latest/meta-data/iam/security-credentials/",
"curl http://169.254.169.254/latest/user-data/",
"curl http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE]/",
]
# GCP metadata
GCP_METADATA = "curl -H 'Metadata-Flavor: Google' http://169.254.169.254/computeMetadata/v1/"
# Azure IMDS
AZURE_IMDS = "curl -H 'Metadata: true' http://169.254.169.254/metadata/instance?api-version=2021-02-01"
Verification Checklist
- IAM policy enumeration (users, roles, policies, trust relationships)
- Privilege escalation paths identified (iam:PassRole, etc.)
- Storage services audited (S3, Blob, GCS — ACLs, public access)
- Metadata service accessible (if running in cloud)
- CloudTrail/CloudWatch logs checked for sensitive data
- Lambda/Cloud Functions checked for secrets in env vars
- KMS keys checked for overly permissive policies
- VPC security groups reviewed for overly broad rules
- Container images scanned for vulnerabilities