Amazon AWS
Penetration Testing
Why is AWS Penetration Testing Important?
Traditional Pentest vs AWS Penetration Test
The AWS platform has a great deal of powerful APIs that are leveraged to access and process assets. Deeply integrated into the AWS ecosystem, our AWS certified specialists test for a range of AWS-specific misconfigurations, including the following:
EC2 instances and applications
AWS IAM user access keys
Cloudtrail logs obfuscation
Lambda backdoor functions
S3 bucket configurations and permissions
AWS APIs & Cloudfront
Our AWS Penetration Testing Services
SaaS Application
Penetration Testing
AWS Infrastructure
Penetration Testing
AWS Configurations
Security Audit
Types of AWS Exploits we Attempt
- User privilege escalation
- Unauthenticated S3 bucket access
- EC2 instance exploitation
- Serverless function alteration
- Business logic implementation exploitation
- Subdomain takeover
- AWS roles enumeration (IAM access keys)
- CloudTrail logging bypass
- DNS rebinding
- Root certificate and SSH keys manipulation
- VM image exfiltration (To steal credentials, keys, certificates, etc.)
- Credentials exfiltration through metadata
- Default policy manipulation
Need a Quote For An
AWS Penetration Test?
Our AWS Penetration Testing Process
Project Scoping
A specialist will reach out to determine the components and relevant details to be included in your detailed proposal.
Penetration Testing
After kickoff, our specialists simulate the attacks used by today's most advanced hackers to identify your vulnerabilities.
Report Writing
We document a complete report offering clear and practical advice on how to address each identified vulnerability.
Report Presentation
The report is presented to your stakeholders to ensure full comprehension of our findings and recommendations.
Frequently Asked Questions
About Our AWS Pentest Services
Do you have more questions? Contact us →
What is the price of an AWS penetration test?
Our AWS pentesting services are customized based on the goal or outcome you want to achieve. Therefore, there is no standard price for a Cloud penetration test.
For each project, we will technically determine your requirements and set the time needed to complete the work. We will then provide a detailed proposal containing the necessary budget for the project and the efforts that will be made by our specialists within the project.
What is included in an AWS penetration test?
At the end of the project, you will be provided with a detailed report that includes all the findings and recommended mitigations. The technical report includes the following:
- Executive summary presenting the main observations and recommendations.
- Vulnerability matrix prioritised by risk level.
- Vulnerabilities details including the following:
- Risk Level based on potential impact and exploitability.
- Fixes & Recommendations to fix the identified vulnerabilities.
- References to external resources to facilitate the implementation of our recommendations.
- Technical details such as screenshots, system traces, logs, etc.
- Appendix detailing complementary technical information.
- Methodology used during the project. (based on recognized standards)
Depending on your context, you will also be provided with an attestation certifying that penetration tests have been performed by experienced professionals using recognized methodologies and standards. This document will allow you to meet compliance and regulatory reporting requirements efficiently and with minimal overhead.
More details regarding these 5 items you should find in a penetration testing report →
How do you test our AWS security?
We have created a set of virtual images containing all the tools needed to validate the security of cloud environments. For example, we can quickly and easily create a virtual machine for you or provide an OVA / OVF file that can be downloaded with all of our preloaded tools.
We then connect to the test virtual machine and evaluate the systems or applications within your Cloud environment.
Do we need permission from Amazon to pentest our cloud?
Amazon no longer requires their authorization in order to perform a penetration test of their Cloud environment.
How often should I assess my security?
It is recommended to perform a penetration test every year as cyber threats and attack scenarios are constantly evolving.
If major changes are made to the infrastructure or if new applications are developed, it is recommended to perform additional tests. This ensures that recent changes did not introduce new vulnerabilities into the environment.
Some compliance standards, such as ISO 27001 or PCI DSS, require tests to be performed at a pre-determined frequency to remain compliant. (For example, the PCI-DSS Compliance Requirement 11.3.x requires a penetration test to be performed each year or following each major change to the infrastructure)
Do you follow a methodology?
Our services are based on a complete methodology provided with each project proposal. It describes the steps that will be taken during the test and all the requirements to perform the test.
Our Cloud Application Penetration Testing methodology complies with OWASP standards, which is the industry standard for application security.
Tell us About Your Cybersecurity Needs
A specialist will reach out to:
- Understand your needs
- Determine your project scope
- Provide a cost estimate
- Send you a detailed proposal