AWS - Accounts Unauthenticated Enum

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Account IDs

대상이 있다면, 대상과 관련된 계정 ID를 식별하기 위한 방법이 있습니다.

Brute-Force

잠재적인 계정 ID와 별칭의 목록을 만들고 이를 확인합니다.

# Check if an account ID exists
curl -v https://<acount_id>.signin.aws.amazon.com
## If response is 404 it doesn't, if 200, it exists
## It also works from account aliases
curl -v https://vodafone-uk2.signin.aws.amazon.com

You can automate this process with this tool.

OSINT

조직과 관련된 별칭이 포함된 <alias>.signin.aws.amazon.com URL을 찾으세요.

Marketplace

판매자가 마켓플레이스에 인스턴스가 있는 경우, 그가 사용한 AWS 계정의 소유자 ID(계정 ID)를 얻을 수 있습니다.

Snapshots

• 공개 EBS 스냅샷 (EC2 -> Snapshots -> Public Snapshots)

• RDS 공개 스냅샷 (RDS -> Snapshots -> All Public Snapshots)

• 공개 AMI (EC2 -> AMIs -> Public images)

Errors

많은 AWS 오류 메시지(접근 거부 포함)가 해당 정보를 제공합니다.

References

• https://www.youtube.com/watch?v=8ZXRw4Ry3mQ

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.