Pentesting Containerized Applications in AWS

One of the most common use cases for cloud networks is the deployment of containerized applications. Over the course of your career as a cloud pentester, the likelihood that you’ll need to test in containerized environments is very high.

The popular containerization platforms, Docker and Kubernetes, operate the same way within their containerization systems regardless of whether they’re deployed in AWS, GCP, Azure, or any other cloud platform. However, the way AWS, GCP, and Azure interface with Docker and Kubernetes is a little bit different in each instance.

Think of it this way. A slice of buttered toast is the same slice of buttered toast whether it’s served on a ceramic dish, an aluminum dish, or a paper dish. The toast will taste the same, and you will eat it the same way regardless of what kind of dish it’s served on. But after you eat the toast, the way you clean or dispose of the dish will be different...

Technical requirements

The wonderful thing about using AWS, whether for containerization or anything else, is that we get to use the computing power of Amazon’s infrastructure. That means you don’t need a really high-end workstation to do any of the exercises in this chapter. All you need is the following:

• A modern desktop or laptop PC running Windows, macOS, or a common Linux distribution such as Ubuntu or Debian. A MacBook or a Windows 11 OEM PC with at least 4 GB of RAM works great.
• A well-supported web browser such as Safari 15 or later, Microsoft Edge 83 or later, Mozilla Firefox 105 or later, or Google Chrome 115 or later.
• A reliable internet connection.

Check out the following video to view the Code in Action: https://bit.ly/46VJSp3

How containerization works

First, there were virtual machines (VMs). VMs run inside a host operating system, and the host operating system is what runs directly on computer hardware. As far as the host operating system is concerned, the VM is simply an application it’s running that has been allocated a certain amount of memory (RAM) and a certain amount of disk space in the form of a virtual disk. VMware and Oracle VirtualBox both make virtualization clients that you can easily run and install on a Windows, Mac, or Linux PC. With those virtualization clients, you can make a VM that runs most versions of Windows, macOS, Linux, or Unix.

There is a plethora of use cases for VMs. My background is in cybersecurity, so the use case I’m most familiar with is malware testing. I can safely execute malware in a VM without harming the host operating system or its hardware. That’s because the VM assures that the virtual operating system is “sandboxed” from...

How Docker works in AWS

The layers in a Docker containerization system look like this, from the bottom to the top:

• AWS, Azure, or GCP is the cloud platform.
• The cloud platform runs a service, such as Amazon Elastic Container Service (Amazon ECS), that supports the Docker host. The Docker host is a server, and the administrator administrates it through their Docker client on their local computer.
• The Docker host runs the Docker daemon, which manages Docker images. The daemon can also download images from the Docker Registry. The registry can be the remote public Docker Hub or the organization’s own private registry. The daemon also handles API requests.
• Docker images are instructions for creating Docker containers. Containers are generated from the images.

Here’s an example of what a Docker architecture looks like:

Figure 6.1 – Docker architecture

Docker deployments in AWS use Amazon Elastic Compute Cloud...

How Kubernetes works in AWS

The layers in a Kubernetes containerization system look like this, from the bottom to the top:

• AWS, Azure, or GCP is the cloud platform.
• The cloud platform runs a service, such as Amazon Elastic Kubernetes Service (Amazon EKS), which supports the control plane.
• The next layer is the control plane, which is managed by Kubernetes. This is the root of the cluster.
• The control plane deploys Pods according to changing network application metrics that the cloud administrator can define. Pods are deployed to be able to manage the needs of your Kubernetes application at any given time. For instance, more users and more bandwidth consumption usually result in more Pods.
• Pods deploy containers.

Here’s a sample diagram of Kubernetes architecture:

Figure 6.2 – Kubernetes architecture

Kubernetes Deployments in AWS use Amazon EC2 because that’s the main compute platform. It’s possible...

Docker and Kubernetes pentesting techniques in AWS

In the previous chapter, I walked you through using Prowler to pentest AWS deployments. I’ll show you some scripts and vulnerability checks you can execute to find Docker and Kubernetes vulnerabilities with a few different tools. But first, it’s worthwhile mentioning here that Prowler can be executed from a Docker instance! You can use Prowler from Docker containers to help pentest your organization’s entire AWS network. Running Prowler from Docker isn’t just for vulnerability assessing Docker.

The same Prowler CLI commands from the previous chapter can be used when you run Prowler from Docker.

Installation in Docker

Here’s how to install Prowler from Docker:

1. Make sure that Docker Desktop is installed on your local computer. Find the Docker Desktop Windows, Mac, and Linux clients here: https://docs.docker.com/get-docker/.
2. Have your AWS credentials ready. You can verify them by...

Summary

Cloud platforms such as AWS, Azure, and GCP are popular because they offer organizations lots of scalability in their massive data centers.

Containerization orchestrated by Docker or Kubernetes takes full advantage of cloud infrastructure by helping organizations manage hardware and software resources better for their networked applications. Containers use virtualization but are much more lightweight and portable than VMs. You will almost definitely be working with containerization as a cloud pentester.

In AWS, Docker is usually run through Amazon ECS, and Kubernetes with Amazon EKS. They’re both interfaces for Amazon EC2.

Docker and Kubernetes pentesting scripts and benchmarks are interchangeable between cloud platforms.

Now that we’ve deployed VMs and containerized applications in AWS and pentested them, we will move on to Microsoft Azure in the next chapter.

Further reading

To learn more about the topics covered in this chapter, you can visit the following links:

• Docker on AWS: https://aws.amazon.com/docker/
• Kubernetes on AWS: https://aws.amazon.com/kubernetes/
• Docker CLI guide: https://docs.docker.com/engine/reference/commandline/cli/
• PWD test lab: https://www.docker.com/play-with-docker/