diff --git a/src/pentesting-cloud/aws-security/README.md b/src/pentesting-cloud/aws-security/README.md index 9a546564f9..eb46c8ba0d 100644 --- a/src/pentesting-cloud/aws-security/README.md +++ b/src/pentesting-cloud/aws-security/README.md @@ -304,6 +304,48 @@ pmapper --profile dev orgs create pmapper --profile dev orgs display ``` +- [**AWSHound**](https://github.com/AWSHound/AWSHound): A read-only collector and offline authorization evaluator that emits a BloodHound OpenGraph for one AWS account or an Organization. Unlike a graph built from policy attachment or trust alone, capability edges are emitted after combining identity and group policies with permissions boundaries, SCPs/RCPs, explicit denies, relevant resource policies, and request conditions.[[50]](#references)[[51]](#references) + +
+Build and collection examples + +```bash +# From an AWSHound source checkout + +go build -o awshound ./cmd/awshound +./awshound all --profile dev -o graph.json + +# Or run the published container + +docker run --rm -v "$PWD:/work" -w /work \ + -v "$HOME/.aws:/root/.aws:ro" \ + ghcr.io/awshound/awshound:latest \ + all --profile dev -o /work/graph.json + +# Several profiles, selected Regions, or an Organization-wide collection +./awshound all --profile dev,staging --regions us-east-1,us-west-2 -o graph.json +./awshound all --profile management \ + --org-role OrganizationAccountAccessRole -o graph.json + +# Re-process an existing raw collection without making AWS API calls +./awshound all --input-dir raw/ -o graph.json +``` + +
+ +The pipeline can also be stopped at `collect`, `process`, and `emit` to inspect raw JSON and the built graph before ingestion. Live collection uses the normal AWS credential chain; `--aws-config` can select profiles marked `bloodhound_collect = true`. During an Organization run, a child account whose collection role cannot be assumed is skipped rather than aborting successful accounts.[[50]](#references)[[51]](#references) + +Interpret the graph as **candidate attack paths**, not automatic proof of exploitation. AWSHound preserves conditions such as external IDs, principal/request/resource tags, source IP, MFA, `kms:ViaService`, and encryption context on edges. Its attacker-favorable static analysis keeps conditional allows it cannot disprove and drops conditional denies it cannot confirm, so every unresolved condition must be validated in the real request context.[[51]](#references) + +Useful graph semantics include:[[51]](#references) + +- `AWS_CanAssumeRole` is traversable only after caller-side `sts:AssumeRole` and the role trust policy both authorize the hop; `AWS_Trusts` alone is informational. Compare the [cross-account authorization model](aws-cross-account-attacks/) and [IAM escalation techniques](aws-privilege-escalation/aws-iam-privesc/). +- `AWS_CanUpdateLambdaCode` followed by `AWS_RunsAs` models [Lambda code replacement](aws-privilege-escalation/aws-lambda-privesc/) and execution as the function role. The same runtime-role pivot is modeled for [SSM command/session access](aws-privilege-escalation/aws-ssm-privesc/) to [EC2](aws-privilege-escalation/aws-ec2-privesc/) and the instance-profile role. +- Composite edges such as `AWS_CanCreateAndAssumeAdminRole` collapse a complete permission combination into an account-takeover hop while retaining the authorizing methods and policies as edge properties. AWSHound also maps execution-role paths through [CloudFormation](aws-privilege-escalation/aws-cloudformation-privesc/) and identity pivots through [EKS](aws-post-exploitation/aws-eks-post-exploitation/). +- Data-access edges such as SSM parameter reads and [KMS decryption](aws-privilege-escalation/aws-kms-privesc/) are deliberately non-traversable: reading or decrypting data does not by itself prove acquisition of another identity. + +Enable every collector required by the path being tested: omitting Organizations removes SCP/RCP restrictions from evaluation, and S3 is disabled by default because of collection cost. Current blind spots include IAM Identity Center assignments, Kubernetes RBAC/workloads, EC2 network paths, secret values, Lambda code/environment values, CloudFormation templates/parameters, cross-account KMS evaluation, and complete S3 object inventory; absence of a path is therefore not proof that none exists.[[51]](#references) + - [**cloudsplaining**](https://github.com/salesforce/cloudsplaining): An AWS IAM assessment tool that identifies least-privilege violations and generates a risk-prioritized report. It can scan account policies or supplied policy files and highlights permissions relevant to privilege escalation, data exposure, and infrastructure modification.[[37]](#references) ```bash @@ -450,5 +492,7 @@ aws ... - [47] [Cloud Custodian repository](https://github.com/cloud-custodian/cloud-custodian) - [48] [PacBot repository](https://github.com/tmobile/pacbot) - [49] [StreamAlert repository](https://github.com/airbnb/streamalert) +- [50] [AWSHound repository and usage](https://github.com/AWSHound/AWSHound) +- [51] [AWSHound: An Open-Source AWS OpenGraph Collector](https://specterops.io/blog/2026/08/19/awshound-opensource-aws-opengraph-collector/) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-codeartifact-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-codeartifact-enum.md index f829128bb6..9625c11106 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-codeartifact-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-codeartifact-enum.md @@ -66,3 +66,4 @@ Publishing the package did **not** start a build automatically. Exploitation req - [2] [GetPackageVersionAsset API](https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_GetPackageVersionAsset.html) - [3] [Packages overview, publishing permissions, and asset overwrite rules](https://docs.aws.amazon.com/codeartifact/latest/ug/packages-overview.html) - [4] [AWS CodeArtifact permissions reference](https://docs.aws.amazon.com/codeartifact/latest/ug/auth-and-access-control-permissions-reference.html) +{{#include ../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-greengrass-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-greengrass-enum.md index ad94fde7bc..91d0c97549 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-greengrass-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-greengrass-enum.md @@ -28,3 +28,4 @@ The same API did **not** retrieve an ordinary private component backed by an arb - [1] [Develop AWS IoT Greengrass components](https://docs.aws.amazon.com/greengrass/v2/developerguide/develop-greengrass-components.html) - [2] [GetComponentVersionArtifact API](https://docs.aws.amazon.com/greengrass/v2/APIReference/API_GetComponentVersionArtifact.html) +{{#include ../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-iot-core-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-iot-core-enum.md index fc368f97aa..1bc7132210 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-iot-core-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-iot-core-enum.md @@ -295,3 +295,4 @@ If listing is denied, tunnel IDs occur in open/rotate responses, device notifica - [16] [IoT SQL FROM clause](https://docs.aws.amazon.com/iot/latest/developerguide/iot-sql-from.html) - [17] [AWS IoT rule actions](https://docs.aws.amazon.com/iot/latest/developerguide/iot-rule-actions.html) - [18] [Publish API - AWS IoT](https://docs.aws.amazon.com/iot/latest/apireference/API_iotdata_Publish.html) +{{#include ../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-ivs-chat-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-ivs-chat-enum.md index 0668a955f4..1e83439359 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-ivs-chat-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-ivs-chat-enum.md @@ -78,3 +78,4 @@ The application-specific user ID and attributes are caller-controlled inputs to - [2] [Amazon IVS Chat Messaging SDK for JavaScript](https://docs.aws.amazon.com/ivs/latest/ChatUserGuide/chat-sdk-js.html) - [3] [Getting started with Amazon IVS Chat](https://docs.aws.amazon.com/ivs/latest/ChatUserGuide/getting-started-chat.html) - [4] [Actions, resources, and condition keys for Amazon IVS Chat](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoninteractivevideoservicechat.html) +{{#include ../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-kinesis-data-streams-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-kinesis-data-streams-enum.md index 8fa908bb64..b8edd6056d 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-kinesis-data-streams-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-kinesis-data-streams-enum.md @@ -44,3 +44,4 @@ Resource policies, IAM policies, KMS configuration, retention, iterator expiry, - [1] [GetShardIterator API](https://docs.aws.amazon.com/kinesis/latest/APIReference/API_GetShardIterator.html) - [2] [GetRecords API](https://docs.aws.amazon.com/kinesis/latest/APIReference/API_GetRecords.html) - [3] [Kinesis Data Streams terminology and concepts](https://docs.aws.amazon.com/streams/latest/dev/key-concepts.html) +{{#include ../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-mediapackage-v2-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-mediapackage-v2-enum.md index 9bed5a2f5c..5a6f9bd26c 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-mediapackage-v2-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-mediapackage-v2-enum.md @@ -1,5 +1,7 @@ # AWS - MediaPackage v2 Enum +{{#include ../../../banners/hacktricks-training.md}} + ## MediaPackage v2 basics AWS Elemental MediaPackage v2 receives live media through channels and serves packaged content through origin endpoints. Both resources support IAM-style resource policies. Consequently, a principal that can replace one of those policies may grant an external principal access without receiving any MediaPackage list or read permission itself. @@ -114,3 +116,4 @@ aws mediapackagev2 delete-channel-group \ - [Channel policy examples](https://docs.aws.amazon.com/mediapackage/latest/userguide/security_iam_resource-based-policy-examples.html) - [PutChannelPolicy API](https://docs.aws.amazon.com/mediapackage/latest/APIReference/API_v2_PutChannelPolicy.html) - [PutOriginEndpointPolicy API](https://docs.aws.amazon.com/mediapackage/latest/APIReference/API_v2_PutOriginEndpointPolicy.html) +{{#include ../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-transcribe-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-transcribe-enum.md index 7559d0bee2..4c4b8ee269 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-transcribe-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-transcribe-enum.md @@ -34,3 +34,4 @@ If `ListTranscriptionJobs` is denied, job names frequently appear without additi - [1] [How Amazon Transcribe works with input and output data](https://docs.aws.amazon.com/transcribe/latest/dg/how-input.html) - [2] [GetTranscriptionJob API](https://docs.aws.amazon.com/transcribe/latest/APIReference/API_GetTranscriptionJob.html) +{{#include ../../../banners/hacktricks-training.md}}