AWS - EC2 Unauthenticated Enum
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
EC2 & Related Services
Check in this page more information about this:
AWS - EC2, EBS, ELB, SSM, VPC & VPN EnumPublic Ports
It's possible to expose the any port of the virtual machines to the internet. Depending on what is running in the exposed the port an attacker could abuse it.
SSRF
Public AMIs & EBS Snapshots
AWS allows to give access to anyone to download AMIs and Snapshots. You can list these resources very easily from your own account:
If you find a snapshot that is restorable by anyone, make sure to check AWS - EBS Snapshot Dump for directions on downloading and looting the snapshot.
Public URL template
Enumerate EC2 instances with public IP
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
Last updated