Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
If you have a target there are ways to try to identify account IDs of accounts related to the target.
You create a list of potential account IDs and aliases and check them
You can automate this process with this tool.
Look for urls that contains <alias>.signin.aws.amazon.com with an alias related to the organization.
If a vendor has instances in the marketplace, you can get the owner id (account id) of the AWS account he used.
Public EBS snapshots (EC2 -> Snapshots -> Public Snapshots)
RDS public snapshots (RDS -> Snapshots -> All Public Snapshots)
Public AMIs (EC2 -> AMIs -> Public images)
Many AWS error messages (even access denied) will give that information.
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
