cloud-penetration-testing

The skill is purpose-aligned with authorized penetration testing and shows no clear evidence of malware or third-party exfiltration. Its extensive exploitation, secret extraction, credential-use, and persistence procedures create high risk if misused or invoked outside the stated approval gate. Treat it as a high-risk offensive security skill; require explicit scoped authorization and review commands before execution.

This Markdown guide is not self-executing, but it documents actionable cloud credential discovery, secret extraction, data copying, remote command execution, and persistence procedures across Azure, AWS, and GCP. Notable indicators include `C:\Temp\StolenToken.json`, `creds.json`, `/home` files named `credentials.db`, AWS metadata at `http://169[.]254[.]169[.]254/latest/meta-data/`, and GCP metadata at `http://metadata[.]google[.]internal/computeMetadata/v1/`. It explicitly describes backdoor Azure principals and users, AWS access-key creation, Key Vault secret retrieval, Lambda environment-variable retrieval, and S3 synchronization, while also including authorization and safety warnings. Severity is high if these procedures are used without explicit authorization; the document itself does not execute them.

This is a readable cloud penetration-testing reference that enumerates cloud resources and may export sensitive configuration, job output, metadata, and inventory data to local files or console output. It also documents device-code authentication and commands capable of resetting credentials, creating a user, and granting Global Administrator privileges; the accompanying guidance restricts these actions to authorized, approved testing. No hidden payload or attacker-controlled exfiltration destination is evident. Severity is elevated if run outside an authorized scope because of sensitive data collection and tenant-changing commands, but the fragment itself does not establish malicious intent.