> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/aws-pentesting/readme.md).

# AWS PenTest Lab — Learn Cloud Hacking from Scratch

```
                                                                                     
                             :++%@@@@@@@@@@@@@@@@@*+-                                
                           -+%@@#:               +@@%*+:                             
                        .+#%@-  .                .  :#@%*:                           
                       ***=.                           -#@*.                         
                      *#:..                              --**                        
                     **:.                                :. +=:---=+=                
                    *-::                                  ::-@@@@@@@**=+:            
                -+==- :                                     .       .*@@#*:          
            -+-+*@@@:.     -@@@@@@@ .#+   @@    @@ @@@#@@#              =#@*:        
         :+*%@@#:   :.     *      @ -+@: @@@@  @:- @:    -                --*#       
        *#**.              :  +-: :* # @ *   *== @ @ ++= :                :  *%      
       *#: .               @#.    :@ @ @+ @@ @@ @  @*   %@                 :. *+     
     .*=-.                :@ #   : @ +%   @=    @  #   * @-                 =  %     
     #: :                 :@-    : *  @%+@  @@@@  =    .*@:                  - *=    
    -# :.                   @@@@@@@@.  @@-   @%   *@@@@#.                    - +#    
    #+ -                                                   =                 = **    
    ** -                  .   =%%#=               .+%* :== *                :  %     
    .%  :                  ++      *#%%%%%%%%%%%%*:      . -                . **     
     **  :                    *%%*.                =#%*  ::               .  ##      
      ##  :                       :*%%%%%%%%%%%%@#-                      .::##       
       **-:                                                             :***=        
        :*%@%:                                                       :*@%*=          
          :*%@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@*-            
                                                                                     

```

> **For educational purposes only. Only test on environments you own or have explicit written permission to test.**

A structured, beginner-to-advanced repository for learning AWS security testing. Each module has theory, real commands, and hands-on labs.

## 🗺️ Repository Structure

```
aws-pentest-lab/
├── modules/
│   ├── 01-iam/                  → IAM enumeration & privilege escalation
│   ├── 02-s3/                   → S3 bucket misconfigurations
│   ├── 03-ec2-ssrf/             → EC2 metadata & SSRF attacks
│   ├── 04-lambda/               → Lambda function abuse
│   ├── 05-secrets/              → Secrets Manager & SSM enumeration
│   ├── 06-cloudtrail/           → CloudTrail evasion & log tampering
│   ├── 07-cross-account/        → Cross-account pivot attacks
│   └── 08-ecs/                  → ECS & container escape
├── scripts/                     → Automation & helper scripts
├── cheatsheets/                 → Quick-reference command sheets
├── labs/                        → Guided CloudGoat walkthroughs
└── resources/                   → Tools, wordlists, references
```

***

## 🚀 Quick Start

### 1. Install prerequisites

```bash
# AWS CLI
pip install awscli --upgrade

# Pacu - AWS exploitation framework
git clone https://github.com/RhinoSecurityLabs/pacu
cd pacu && pip3 install -r requirements.txt

# enumerate-iam - brute force permissions
git clone https://github.com/andresriancho/enumerate-iam
pip3 install -r enumerate-iam/requirements.txt

# ScoutSuite - cloud auditing
pip3 install scoutsuite
```

### 2. Set up a free vulnerable lab (CloudGoat)

```bash
git clone https://github.com/RhinoSecurityLabs/cloudgoat
cd cloudgoat
pip3 install -r requirements.txt
./cloudgoat.py config profile  # set your AWS profile
./cloudgoat.py create iam_privesc_by_rollback  # start a scenario
```

### 3. Configure test credentials

```bash
aws configure --profile pentest
# Enter: Access Key ID, Secret Access Key, region, output format
```

***

## 📚 Learning Path

| Phase | Module                | Difficulty      | Time |
| ----- | --------------------- | --------------- | ---- |
| 1     | IAM Enumeration       | 🟢 Beginner     | 2h   |
| 2     | S3 Misconfigs         | 🟢 Beginner     | 1.5h |
| 3     | EC2 SSRF              | 🟡 Intermediate | 2h   |
| 4     | Lambda Abuse          | 🟡 Intermediate | 2h   |
| 5     | Secrets Enumeration   | 🟡 Intermediate | 1h   |
| 6     | CloudTrail Evasion    | 🔴 Advanced     | 3h   |
| 7     | Cross-Account Attacks | 🔴 Advanced     | 3h   |
| 8     | ECS Container Escape  | 🔴 Advanced     | 2h   |

***

## ⚠️ Legal Disclaimer

This repository is for **authorized security testing and education only**.

* Never test AWS accounts you don't own
* Always get written permission before testing
* Use CloudGoat or your own AWS account for practice
* Unauthorized testing violates the AWS Acceptable Use Policy and computer crime laws

Thanks for reading it!

* Alham Rizvi

## 📖 Resources

* [MITRE ATT\&CK for Cloud](https://attack.mitre.org/matrices/enterprise/cloud/)
* [HackTricks AWS](https://cloud.hacktricks.xyz/pentesting-cloud/aws-pentesting)
* [Rhino Security Labs Blog](https://rhinosecuritylabs.com/blog/)
* [CloudGoat Scenarios](https://github.com/RhinoSecurityLabs/cloudgoat)
* [Pacu Documentation](https://github.com/RhinoSecurityLabs/pacu/wiki)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/aws-pentesting/readme.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.