AWS Penetration Testing
Warn
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: MEDIUMPRIVILEGE_ESCALATIONDATA_EXFILTRATIONREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPERSISTENCEEXTERNAL_DOWNLOADS
Full Analysis
- [PRIVILEGE_ESCALATION]: The skill provides extensive documentation on escalating IAM privileges, including methods to attach the 'AdministratorAccess' policy to a compromised user, create new access keys for administrative accounts, and inject privilege escalation code into Lambda functions.
- [DATA_EXFILTRATION]: Provides step-by-step guides for harvesting temporary credentials from the EC2 metadata endpoint (IMDSv1 and v2) and the Fargate runtime environment. It also describes techniques for stealing data by mounting EBS snapshots and synchronizing S3 buckets.
- [REMOTE_CODE_EXECUTION]: Includes Python code snippets and CLI commands to inject malicious logic into existing Lambda functions and execute arbitrary shell commands on EC2 instances using AWS Systems Manager (SSM).
- [PERSISTENCE]: Details mechanisms for maintaining access, such as backdooring Lambda functions and pushing compromised container images to the Elastic Container Registry (ECR).
- [EXTERNAL_DOWNLOADS]: Recommends and provides installation commands for several third-party exploitation frameworks and auditing tools from external GitHub repositories.
- [COMMAND_EXECUTION]: Contains specific instructions on how to disable or delete AWS CloudTrail logs to hide administrative actions and evade detection systems like GuardDuty.
Audit Metadata