AWS - Security Hub Enum

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Security Hub

Security Hub prikuplja bezbednosne podatke iz različitih AWS naloga, usluga i podržanih proizvoda trećih strana i pomaže vam da analizirate svoje bezbednosne trendove i identifikujete najprioritetnije bezbednosne probleme.

Ona centralizuje bezbednosne alarme između naloga, i pruža UI za pregled ovih. Najveće ograničenje je to što ne centralizuje alarme između regiona, samo između naloga.

Karakteristike

• Regionalno (nalazi se ne preklapaju između regiona)

• Podrška za više naloga

• Nalazi iz:

• Guard Duty

• Config

• Inspector

• Macie

• treće strane

• samoproizvedeni prema CIS standardima

Enumeration

# Get basic info
aws securityhub describe-hub

# Get securityhub org config
aws securityhub describe-organization-configuration #If the current account isn't the security hub admin, you will get an error

# Get the configured admin for securityhub
aws securityhub get-administrator-account
aws securityhub get-master-account # Another way
aws securityhub list-organization-admin-accounts # Another way

# Get enabled standards
aws securityhub get-enabled-standards

# Get the findings
aws securityhub get-findings

# Get insights
aws securityhub get-insights

# Get Automation rules (must be from the admin account)
aws securityhub list-automation-rules

# Get members (must be from the admin account)
aws securityhub list-members
aws securityhub get-members --account-ids <acc-id>

Bypass Detection

TODO, PRs accepted

References

• https://cloudsecdocs.com/aws/services/logging/other/#general-info

• https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html

Učite i vežbajte AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Učite i vežbajte GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Podržite HackTricks

• Proverite planove pretplate!

• Pridružite se 💬 Discord grupi ili telegram grupi ili pratite nas na Twitteru 🐦 @hacktricks_live.

• Podelite hakerske trikove slanjem PR-ova na HackTricks i HackTricks Cloud github repozitorijume.