Pentesting AWS Features through Serverless Applications and Tools

You’ve been a very patient reader so far. Understanding concepts and theory is important before you start learning how to conduct the practical aspect of pentesting. You’ve now reached the first chapter of the book where we’ll not just be theorizing but also putting our knowledge into action.

This chapter features step-by-step guides to using the Amazon Web Services (AWS) first-party security tools to check security configurations and conduct vulnerability assessments to configure the most popular third-party AWS pentesting tools. We will also discuss the pentesting steps to find credentials, enumerate AWS services, conduct vulnerability scans, and discover exposed services with Prowler and Pacu.

This chapter comprises the following main topics:

• How to get an AWS network
• Using AWS PowerShell and the AWS CLI
• Exploring AWS native security tools
• Installing and preparing AWS...

Technical requirements

We will be working with Microsoft’s infrastructure. Massive Azure data centers will be doing the bulk of the computer processing work for the exercises in this chapter, so, fortunately, you don’t need to have a top-of-the-line workstation. You will need the following:

• A web browser
• A desktop or laptop PC
• An Android or iPhone smartphone
• A good reliable internet connection

Check out the following video to view the Code in Action: https://bit.ly/3Qo5Ewg

How to get an AWS network

Before we prepare to pentest AWS services, we need AWS services to pentest! There are two things you could do:

• You can acquire AWS credentials from the organization you work for
• Or if you’re just learning and you’re not working for an organization yet, you can set up your own AWS instance free of charge

Amazon allows people to do a lot of things on its infrastructure through free services and free trials.

Keep in mind that whether you’re using your organization’s paid AWS instance or your own free AWS instance, the same AWS pentesting policies apply. Refer to Chapters 2 and 3 for more details. You may also review AWS’s pentesting policies here: https://github.com/prowler-cloud/prowler.

If you need to set up a free AWS instance, I’ll walk you through the setup process. Follow these steps:

1. Visit https://aws.amazon.com/ in your web browser.
2. Click on the orange button on the upper-right...

Using AWS PowerShell and the AWS CLI

A lot of the exercises in this chapter can be executed directly from AWS CloudShell. As long as you have a Windows, Linux, or Mac computer with internet access and a web browser, AWS CloudShell is easy to access. Your computer doesn’t need to have a workstation or gaming PC hardware specifications, because all the virtualization and computation are conducted on Amazon’s infrastructure. But I would definitely recommend that you use some sort of desktop or laptop computer, and not a phone or tablet. AWS CloudShell’s UI works best with a physical keyboard.

When you’re logged in to your AWS account in your web browser, you can access AWS CloudShell at any time by clicking on an icon at the top of your screen. The AWS CloudShell icon looks like a small square with a command prompt:

Figure 5.1 – AWS CloudShell icon

If you would prefer to access the AWS CLI without AWS CloudShell, you...

Exploring AWS-native security tools

AWS provides you with two native tools that will be especially useful to you as a pentester: AWS Security Hub and Amazon Inspector.

First, let’s take a look at AWS Security Hub.

AWS Security Hub

AWS Security Hub is an easy way to view all of your AWS security configurations, AWS-native security scan reports, and security alerts. It can combine data from Amazon GuardDuty, Amazon Inspector, Amazon Macie, and AWS Network Firewall.

If there are any major security problems in your AWS instance, AWS Security Hub will notify you! You can mention data you find in AWS Security Hub in your pentest report. But by conducting vulnerability scans and pentests with third-party applications, you may be able to find additional vulnerabilities. I recommend using both the tools AWS provides and third-party tools to get the most thorough data about the security posture of your AWS instance.

Let’s take a look at AWS Security Hub for the first...

Installing and preparing AWS pentesting tools

Let’s install and prepare the third-party software we’ll be using in the next section.

Important note

If you encounter problems with disk space while installing any of these tools, you may have to delete old files to make space. Files can be deleted with the Bash commands earlier in this chapter. You also may have to deploy a new AWS EC2 instance. See the official AWS documentation for more information: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EC2_GetStarted.html.

As much as possible, I will be using AWS CloudShell to install applications.

First, let’s start with Prowler.

Prowler

Prowler is a vulnerability scanner for cloud platforms. Prowler can scan AWS for vulnerabilities and security misconfigurations based on the Center for Internet Security (CIS), National Institute of Standards and Technology (NIST) 800, NIST Cybersecurity Framework (CSF), the Cybersecurity and Infrastructure Security...

Exploiting AWS applications

Now that we’ve installed a number of pentesting applications and run some simple scripts, let’s get deeper into AWS exploitation with Prowler and Pacu.

Prowler

First, let’s conduct some pentesting and vulnerability scanning activities in Prowler.

Have your AWS credentials ready. You can verify them by logging in to your AWS account from your web browser. On the top menu bar, look at the far right drop-down menu with your username. Click on Security credentials to navigate to the correct AWS Identity and Access Management (IAM) page. At the top, it should say My security credentials (root user). Make a note of your AWS account ID, access key ID, and secret access key. Then, follow these steps:

1. Now, let’s open AWS CloudShell again. Enter this command to configure your key:

   aws configure

2. In the AWS_ACCESS_KEY_ID= field, paste the key ID you generated and hit Enter. Hit Enter for all the other fields too; we’...

Summary

Anyone can set up an AWS account under their Free Tier to try out some general AWS pentesting tools.

AWS has its own applications that will be useful to you as a pentester. They include AWS CloudShell, AWS Security Hub, and Amazon Inspector.

AWS CloudShell gives you a CLI you can use from your web browser once you’ve logged in to your AWS account. Alternatively, you can use the AWS CLI application, which you can install directly on your Windows, Mac, or Linux PC.

AWS Security Hub is a handy unified application for checking all of your AWS security settings, configurations, and reports.

Amazon Inspector is AWS’s native vulnerability scanning application. I would recommend using it in addition to the other vulnerability scanners and pentesting applications I demonstrate in this book.

A wide range of vulnerability scans and pentests can be executed with Prowler, Cred Scanner, CloudFrunt, and Pacu. These tools help you find security problems such as...

Further reading

To learn more about the topics covered in this chapter, you can visit the following links:

• AWS CloudShell documentation: https://docs.aws.amazon.com/cloudshell/
• Install Prowler: https://github.com/prowler-cloud/prowler
• Prowler documentation: https://docs.prowler.cloud/en/latest/
• Pacu: https://github.com/RhinoSecurityLabs/pacu