CodeBuild GitHub runners can become AWS persistence. Backdoor a role trust policy, connect a runner project to an attacker repo, and trigger workflows inside the victim account. hackingthe.cloud/aws/post_exp...

Retiring cloud resources in the wrong order can leave takeover paths behind. This covers DNS and CloudFront records pointing at deleted S3 buckets, plus AWS's newer error behavior. hackingthe.cloud/aws/exploita...

Public AWS exposure is not just S3. This playbook covers quick CLI paths for AMIs, snapshots, SSM docs, roles, and CloudFront-backed buckets. hackingthe.cloud/aws/exploita...

A mounted Docker socket in Cloud Workstations can turn a dev shell into a host breakout. This walks through escape, VM service account token theft, and why scopes still matter. hackingthe.cloud/gcp/exploita...

IAM Roles Anywhere can become AWS persistence. With enough access, an attacker can register a malicious CA as a trust anchor, bind it to a role profile, and mint credentials from outside AWS. hackingthe.cloud/aws/post_exp...

Deleted Azure blobs are not always gone. If soft delete is enabled and an attacker gets a storage connection string, they may be able to list, undelete, and recover files that everyone assumed were removed. hackingthe.cloud/azure/soft-d...

S3 exfil does not always need a local file write. This shows how to stream an object from a victim bucket to an attacker bucket so the victim sees GetObject while PutObject lands in the attacker account. hackingthe.cloud/aws/exploita...

GCP privilege escalation often starts with one dangerous permission. This reference maps Cloud Build, service account, Cloud Run, org policy, and HMAC key paths to public research and scripts. hackingthe.cloud/gcp/exploita...

Found AWS keys and need the principal name? This covers API calls that leak the caller ARN and account ID through access denied errors, giving you options beyond sts:GetCallerIdentity. hackingthe.cloud/aws/enumerat...

GCP service account names tell you more than they first seem to. This quick reference covers default account formats, common key filenames, and the env var pattern you will spot in reviews and recon. hackingthe.cloud/gcp/general-...

One Entra Agent ID blueprint can authenticate every agent identity tied to it. If that blueprint credential leaks, the blast radius can span agents, users, permissions, and even tenants. securitylabs.datadoghq.com/articles/age...

A deny-all session policy can turn verbose AWS `AccessDenied` errors into a public-exposure oracle. If the error says the session policy blocked the request, the resource policy may have allowed it. This post breaks down the signal and the caveats.

Detect Public Resource Exposure via Session Policy Error Messages - Hacking The Cloud

Use session policy denials and verbose IAM error messages to determine if AWS resources have public resource-based policies.

buff.ly

Compromise the AWS Organizations management account and the default `OrganizationAccountAccessRole` can turn member accounts into admin-level pivots. This post walks through where that role appears, how trusted access and delegated admin change the picture, and where Pacu helps. buff.ly/sWrY7ra

AWS Organizations Defaults & Pivoting - Hacking The Cloud

How to abuse AWS Organizations' default behavior and lateral movement capabilities.

buff.ly

A public S3 bucket name can leak more than objects. By abusing `s3:ResourceAccount` wildcard matching, you can brute-force the AWS account ID behind the bucket one digit at a time.

Enumerate AWS Account ID from a Public S3 Bucket - Hacking The Cloud

Knowing only the name of a public S3 bucket, you can ascertain the account ID it resides in.

buff.ly

AWS persistence can hide in a rogue OIDC provider. Backdoor a role trust policy, then later use `AssumeRoleWithWebIdentity` to get fresh role credentials.

IAM Rogue OIDC Identity Provider Persistence - Hacking The Cloud

Obtain persistence by creating a rogue OIDC Identity Provider.

buff.ly

Azure Run Command is a quiet path to VM execution. If an identity can call `Microsoft.Compute/virtualMachines/runCommands/action`, scripts run through the VM agent as SYSTEM on Windows or root on Linux.

Run Command Abuse - Hacking The Cloud

Utilise Azure RunCommands for execution and lateral movement.

buff.ly

CVE-2024-28056 is not only a cross-account story. If an AWS account still has an old vulnerable Amplify role and a same-account Cognito identity pool with classic authflow, role takeover may still be possible.

CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios - Hacking The Cloud

An in-depth explanation of how to still abuse CVE-2024-28056, a vulnerability in AWS Amplify that exposed IAM roles to takeover.

buff.ly

GuardDuty PenTest findings can hinge on an AWS API User-Agent. This post shows how boto3/botocore builds that string, how it can be changed, and why defenders should treat it as a weak signal.

Bypass GuardDuty Pentest Findings via Botocore Config - Hacking The Cloud

Override the default botocore user-agent string in boto3 to prevent GuardDuty PenTest findings from firing.

buff.ly

An EC2 foothold can get weird fast. This post shows how SSM Agent traffic can be spoofed: race the real agent for EC2 Messages, force Success, or open your own SSM Sessions control channel.

Intercept SSM Communications - Hacking The Cloud

With access to an EC2 instance you can intercept, modify, and spoof SSM communications.

buff.ly

Two AWS CLI habits: use `-` to stream S3 objects without temp files, and set `AWS_EXECUTION_ENV` to add context to CloudTrail user-agents. Small tricks that make AWS work less annoying.

AWS CLI Tips and Tricks - Hacking The Cloud

A collection of tips and tricks for using the AWS CLI.

buff.ly

Got an AWS IAM unique ID and need the ARN behind it? For AIDA and AROA identifiers, AWS can do the lookup for you: place the ID in a resource-based policy, save, refresh, and watch it resolve to the principal ARN.

Derive a Principal ARN from an AWS Unique Identifier - Hacking The Cloud

How to convert an unique identifier to a principal ARN.

buff.ly

What if you could maintain AWS access indefinitely without creating users or keys? Role chain juggling exploits how assume-role refreshes credential expiration. Chain calls to the same role or cycle between roles to keep access alive.

Role Chain Juggling - Hacking The Cloud

Keep your access by chaining assume-role calls.

buff.ly

Can attackers undo your containment actions before they take effect? IAM's eventual consistency creates a 4-second window where deleted creds stay valid. Attackers can detect and remove deny-all policies before propagation completes.

IAM Persistence through Eventual Consistency - Hacking The Cloud

Abuse IAM's eventual consistency to maintain persistence against incident response containment.

buff.ly

ICYMI: Our latest article covers Daniel Grzelak's research on how AWS error messages can reveal publicly exposed resources, without needing access! We cover how to use them for enumeration and detection.

Detect Public Resource Exposure via Session Policy Error Messages - Hacking The Cloud

Use session policy denials and verbose IAM error messages to determine if AWS resources have public resource-based policies.

buff.ly

Can attackers hide GCP projects in plain sight? Apps Script projects create hidden sys-* folders invisible in the console. Attackers can mimic this naming convention to stash service accounts or compute instances where no one looks.

Apps Script project impersonation / Google Apps Script persistence - Hacking The Cloud

Google Workspace Apps Script projects create hidden GCP projects (sys-<...>) that can be impersonated by attackers. This technique enables stealthy persistence (service accounts, hidden compute,…

buff.ly

AI agents are becoming identity infrastructure, whether we’re ready or not. While investigating agent controls, the Datadog Security Research Team found that Copilot Studio wasn’t recording certain administrative changes to agents, exposing a potential monitoring blind spot.

Uncovering agent logging gaps in Copilot Studio | Datadog Security Labs

During research, we sometimes encounter scenarios that remind us that it's a good idea to trust but verify. In September 2025, we noticed that certain Microsoft Copilot Studio agent settings did not…

buff.ly

Got shell access to an EC2 instance? You can enumerate the AWS account ID using two methods: get-caller-identity if an instance profile exists, or the metadata service at 169.254.169.254. Both reveal the account ID plus useful context like region and instance type.

Enumerate AWS Account ID from an EC2 Instance - Hacking The Cloud

With access to an ec2 instance, you will be able to identify the AWS account it runs in.

buff.ly

Got a list of potential corporate emails? You can verify which ones are valid Azure AD accounts without authentication using tools like CredMaster or Quiet Riot. Useful for password spraying or even pivoting to AWS root user testing.

Unauthenticated Enumeration of Azure Active Directory Email Addresses - Hacking The Cloud

Discover how to exploit information disclosure configurations in Azure Active Directory to enumerate valid email addresses.

buff.ly

What if an attacker could turn a simple Cognito login into full AWS account access? Misconfigured Identity Pools can grant excessive IAM permissions to anyone who authenticates, even anonymous users. Learn how this exploitation chain works.

Abusing Overpermissioned AWS Cognito Identity Pools - Hacking The Cloud

How to take advantage of misconfigured Amazon Cognito Identity Pools.

buff.ly

EC2 user data scripts often contain hardcoded credentials, despite AWS explicitly warning against it. If you gain access to an instance, check 169.254.169.254/latest/user-... immediately.

Introduction to User Data - Hacking The Cloud

An introduction to EC2 User Data and how to access it.

buff.ly