Does it support testing for both IMDSv1 and IMDSv2?

Yes, the skill includes specific workflows and token-based requests required to test the security of both legacy and modern EC2 metadata service versions.

Can this skill identify IAM 'Shadow Admins'?

Yes, it provides specific techniques to discover users with permissions like iam:CreateAccessKey or iam:PassRole that effectively grant administrative control.

What tools are required to use this AWS penetration testing skill?

This skill leverages several industry-standard tools including Pacu, Prowler, ScoutSuite, SkyArk, and the AWS CLI configured with Python 3 and boto3.

Is this skill suitable for defensive security teams?

Absolutely. While it uses offensive techniques, it is an essential tool for Blue Teams and DevSecOps to audit their own infrastructure and close security gaps before they are exploited.

AWS Penetration Testing

Name: AWS Penetration Testing
Author: claudiodearaujo

byclaudiodearaujo

•

セキュリティとテスト

Performs comprehensive security audits and identifies vulnerabilities within AWS cloud environments through advanced enumeration and exploitation techniques.

The AWS Penetration Testing skill provides a specialized framework for assessing the security posture of Amazon Web Services infrastructure. It guides users through critical red team operations, including IAM permission enumeration, the discovery of 'Shadow Admin' privilege escalation paths, and the exploitation of S3 buckets and Lambda functions. By providing structured workflows for metadata SSRF attacks (IMDSv1/v2) and persistence mechanism identification, this skill enables security professionals to proactively harden cloud resources and mitigate risks associated with misconfigured identities and exposed credentials.

主な機能

01Automated IAM enumeration and privilege escalation path discovery

02Lambda function and SSM command execution exploitation guides

03Integration workflows for tools like Pacu, Prowler, and ScoutSuite

041 GitHub stars

05EC2 metadata SSRF exploitation patterns for IMDSv1 and IMDSv2

06S3 bucket discovery and misconfiguration auditing techniques

ユースケース

01Testing web application resilience against cloud-specific SSRF vulnerabilities

02Conducting professional red team assessments on corporate AWS environments

03Identifying and remediating 'Shadow Admin' risks within complex IAM hierarchies

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add claudiodearaujo/sistema-de-narra-o-de-livro aws-penetration-testing

For use in Claude.ai and ChatGPT

Download Skill