AWS Penetration Testing
Warn
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONPRIVILEGE_ESCALATIONPERSISTENCE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous commands for interacting with AWS infrastructure, including
aws ssm send-commandwhich permits running arbitrary shell scripts on EC2 instances. - [PRIVILEGE_ESCALATION]: Includes explicit instructions for acquiring administrator privileges by attaching the
AdministratorAccesspolicy to compromised accounts or roles usingiam:AttachUserPolicyandiam:PutUserPolicy. - [DATA_EXFILTRATION]: Detailed techniques for exploiting Server-Side Request Forgery (SSRF) to access the AWS metadata service at
169.254.169.254to harvest temporary IAM credentials. - [PERSISTENCE]: Contains methods for maintaining access to the environment by backdooring AWS Lambda functions through
aws lambda update-function-codeand injecting code into container images stored in Amazon ECR. - [REMOTE_CODE_EXECUTION]: Directs the agent to download and install security tools from various external GitHub repositories, including Pacu, enumerate-iam, and CloudMapper.
- [CREDENTIALS_UNSAFE]: Outlines the extraction of sensitive environment variables and credentials from
/proc/self/environand EC2/Fargate metadata endpoints. - [COMMAND_EXECUTION]: Instructs on how to disable or delete CloudTrail logs using
aws cloudtrail delete-trail, a technique typically used to evade detection and cover malicious activities.
Audit Metadata