What AWS services are covered by this skill?

This skill provides testing methodologies for IAM, EC2, S3, Lambda, Systems Manager (SSM), CloudTrail, and Fargate security assessments.

Is it safe to use on production environments?

The skill includes strict constraints and warnings to avoid modifying production data without approval and emphasizes obtaining written authorization before any testing.

Does this tool support IMDSv2 security testing?

Yes, it includes specific workflows for both IMDSv1 (direct access) and IMDSv2 (token-based) metadata service exploitation.

Can this skill help identify privilege escalation paths?

Yes, it specifically targets 'Shadow Admin' permissions and provides step-by-step methods to escalate from low-privilege roles to administrative access.

AWS Penetration Testing & Security Audit

Name: AWS Penetration Testing & Security Audit
Author: claudiodearaujo

byclaudiodearaujo

0•

Seguridad y Pruebas

Conducts comprehensive security assessments and penetration testing across Amazon Web Services environments to identify vulnerabilities and privilege escalation paths.

This skill provides a robust framework for performing security audits and red team operations within AWS cloud infrastructures. It guides users through critical phases of a penetration test, including IAM permission enumeration, exploiting SSRF via metadata endpoints (IMDSv1/v2), S3 bucket discovery, and Lambda function exploitation. By integrating industry-standard tools like Pacu, Prowler, and ScoutSuite, it helps security professionals identify 'Shadow Admin' permissions, map complex privilege escalation paths, and implement persistence mechanisms, all while providing guidance on maintaining an audit trail and adhering to ethical testing constraints.

Características Principales

01Metadata service exploitation (SSRF) for EC2 and Fargate environments

02Lambda and SSM command execution exploitation for remote access

030 GitHub stars

04S3 bucket discovery, enumeration, and data extraction techniques

05Integration with security tools like Pacu, Prowler, and ScoutSuite

06IAM enumeration and automated privilege escalation path discovery

Casos de Uso

01Conducting a security audit to identify over-privileged IAM users and 'Shadow Admins'

02Performing an authorized red team engagement on AWS cloud infrastructure

03Testing web application vulnerabilities for potential AWS metadata credential leakage

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add claudiodearaujo/izacenter aws-penetration-testing

For use in Claude.ai and ChatGPT

Download Skill