Amazon AWS
Penetration Testing
Why is AWS Penetration Testing Important?
AWS penetration tests are different from regular assessments, as they have their own set of validations specific to the 90+ services offered by the platform. While some vulnerabilities are managed and mitigated by Amazon, the immense flexibility that is provided to the users in setting up the environment, their assets and their user permissions creates many vulnerabilities that can have a critical impact on your business. These assessments focus on your organization’s configurations of various assets and components within your infrastructure to identify potential misconfigurations and flaws that could lead, for example, to user privilege escalation, allowing attackers to gain administrative access.
Traditional Pentest vs AWS Penetration Test
The AWS platform has a great deal of powerful APIs that are leveraged to access and process assets. Deeply integrated into the AWS ecosystem, our AWS certified specialists test for a range of AWS-specific misconfigurations, including the following:
EC2 instances and applications
AWS IAM user access keys
Cloudtrail logs obfuscation
Lambda backdoor functions
S3 bucket configurations and permissions
AWS APIs & Cloudfront
Our AWS Penetration Testing Services
SaaS Application
Penetration Testing
AWS Infrastructure
Penetration Testing
AWS Configurations
Security Audit
Types of AWS Exploits we Attempt
- User privilege escalation
- Unauthenticated S3 bucket access
- EC2 instance exploitation
- Serverless function alteration
- Business logic implementation exploitation
- Subdomain takeover
- AWS roles enumeration (IAM access keys)
- CloudTrail logging bypass
- DNS rebinding
- Root certificate and SSH keys manipulation
- VM image exfiltration (To steal credentials, keys, certificates, etc.)
- Credentials exfiltration through metadata
- Default policy manipulation
Need a Quote For An
AWS Penetration Test?
Our AWS Penetration Testing Process
Requirements
Scoping
We work with you to scope the project properly and make sure that your proposal meets your expectations.
Penetration
Testing
Our specialists simulate the attack methodologies of today's most advanced hackers to identify your vulnerabilities.
Report
Writing
A comprehensive report offering clear and practical advice on how to address each identified vulnerability.
Report
Presentation
The report is presented to your stakeholders to ensure full comprehension of our findings and recommendations.
Frequently Asked Questions
About Our AWS Pentest Services
Do you have more questions? Contact us →
What is the cost of an AWS penetration test?
For each project, we will technically determine your requirements and set the time needed to complete the work. We will then provide a detailed proposal containing the necessary budget for the project and the efforts that will be made by our specialists within the project.
Get a Free Quote →
What's included in my AWS penetration testing report?
- Executive summary presenting the main observations and recommendations.
- Vulnerability matrix prioritised by risk level.
- Vulnerabilities details including the following:
- Risk Level based on potential impact and exploitability.
- Fixes & Recommendations to fix the identified vulnerabilities.
- References to external resources to facilitate the implementation of our recommendations.
- Technical details such as screenshots, system traces, logs, etc.
- Appendix detailing complementary technical information.
- Methodology used during the project. (based on recognized standards)
More details regarding these 5 items you should find in a penetration testing report →
Do we need Amazon's permission to pentest our AWS?
As of 2019, Amazon’s authorization is no longer required in order to perform Penetration Tests within the AWS environment.
How do you test AWS infrastructures?
We have created a set of virtual images containing all the tools needed to assess the security of AWS environments. For example, we can easily create a virtual machine or provide an OVA / OVF file that can be downloaded with all of our preloaded tools, which avoids delays.
We then connect to the test virtual machine and evaluate the systems or applications within your AWS hosting.
Our specialists test the security of a variety of AWS-specific configurations, including the following:
• EC2 Instance and Application Exploitation
• Attempts to target and compromise AWS AMI keys
• Test of the S3 compartment configuration and authorization flaws
• Establish Private Cloud Access via Lambda Functions
• Cover tracks by obscuring CloudTrail event logs
How often should AWS pentests be conducted?
Do you follow a methodology?
Our services are based on a complete methodology that we provide with each project proposal. This proposal describes the test steps and all the requirements to perform the test.
Our application penetration test methodology complies with OWASP standards, which is the industry standard for application security.
Tell us About Your Cybersecurity Needs
A specialist will reach out to:
- Understand your needs
- Determine your project scope
- Provide a cost approximation
- Send you a detailed proposal
