Mastodawn

What if you could maintain AWS access indefinitely without creating users or keys? Role chain juggling takes advantage of a built-in AWS behavior: when you use one assumed role to assume another, the credential expiration timer resets.

This means you can chain assume-role calls repeatedly to keep credentials fresh. You can even chain the same role to itself if the trust policy allows it, or find two roles that can assume each other and cycle between them.

https://hackingthe.cloud/aws/post_exploitation/role-chain-juggling/?mtm_campaign=social_mastodon

Role Chain Juggling - Hacking The Cloud

Keep your access by chaining assume-role calls.

Hacking the Cloud Mar 24

Can attackers undo your containment actions before they take effect? AWS IAM's eventual consistency creates a roughly 4-second window where policy changes haven't fully propagated. An attacker monitoring for containment can detect a deny-all policy and delete it before enforcement kicks in.

https://hackingthe.cloud/aws/post_exploitation/iam_persistence_eventual_consistency/?mtm_campaign=social_mastodon

IAM Persistence through Eventual Consistency - Hacking The Cloud

Abuse IAM's eventual consistency to maintain persistence against incident response containment.

Hacking the Cloud Mar 23

ICYMI: Our latest article covers Daniel Grzelak's research on how AWS error messages can reveal publicly exposed resources, without needing access! We cover how to use them for enumeration and detection.
https://hackingthe.cloud/aws/enumeration/detect_public_resource_exposure_via_error_messages/

Detect Public Resource Exposure via Session Policy Error Messages - Hacking The Cloud

Use session policy denials and verbose IAM error messages to determine if AWS resources have public resource-based policies.

Hacking the Cloud Mar 18

What if attackers could create GCP projects that are effectively invisible in your console? Apps Script projects live in hidden sys-* folders that don't appear in standard project lists. By creating projects that mimic this naming convention, attackers can establish persistence through service accounts or spin up compute for cryptomining, all while staying off the radar.

https://hackingthe.cloud/gcp/avoid-detection/apps-script-abuse/?mtm_campaign=social_mastodon

Apps Script project impersonation / Google Apps Script persistence - Hacking The Cloud

Google Workspace Apps Script projects create hidden GCP projects (sys-<...>) that can be impersonated by attackers. This technique enables stealthy persistence (service accounts, hidden compute, cryptomining) and can bypass common console inspections.

Hacking the Cloud Mar 16

AI agents are becoming identity infrastructure, whether we’re ready or not. While investigating agent management controls, the Datadog Security Research Team found that Copilot Studio wasn’t recording certain administrative changes to agents, exposing a potential monitoring blind spot. https://securitylabs.datadoghq.com/articles/copilot-studio-logging-gaps/

Uncovering agent logging gaps in Copilot Studio | Datadog Security Labs

During research, we sometimes encounter scenarios that remind us that it's a good idea to trust but verify. In September 2025, we noticed that certain Microsoft Copilot Studio agent settings did not log certain administrative actions related to sharing, authentication, logging, and publication of Copilot Studio agents.

Hacking the Cloud Mar 12

Got shell access to an EC2 instance? You can quickly enumerate the AWS account ID through two reliable methods.

First, try aws sts get-caller-identity - if an instance profile is attached, it returns the account ID, user ID, and ARN directly.

Second, query the instance metadata service at 169.254.169.254. The instance-identity document reveals account ID, region, availability zone, instance type, and more. Just remember to grab an IMDSv2 token first.

https://hackingthe.cloud/aws/enumeration/account_id_from_ec2/?mtm_campaign=social_mastodon

Enumerate AWS Account ID from an EC2 Instance - Hacking The Cloud

With access to an ec2 instance, you will be able to identify the AWS account it runs in.

Hacking the Cloud Mar 4

Got a list of potential corporate emails? You can verify which ones are valid Azure AD accounts without any authentication using tools like CredMaster or Quiet Riot. Once you have confirmed valid addresses, they become candidates for password spraying attacks. Bonus: if the organization uses the same email for AWS root accounts, you can pivot your targeting there too. https://hackingthe.cloud/azure/enum_email_addresses/?mtm_campaign=social_mastodon

Unauthenticated Enumeration of Azure Active Directory Email Addresses - Hacking The Cloud

Discover how to exploit information disclosure configurations in Azure Active Directory to enumerate valid email addresses.

Hacking the Cloud Feb 26

What if a simple Cognito login could grant an attacker access to your S3 buckets, DynamoDB tables, or worse? When AWS Cognito Identity Pools are configured with excessive IAM permissions, authenticated users receive temporary credentials that let them far exceed their intended access. Authenticate to a user pool, exchange the ID token for AWS credentials, then leverage whatever permissions the Identity Pool grants. Even unauthenticated users can be affected.

https://hackingthe.cloud/aws/exploitation/cognito_identity_pool_excessive_privileges/?mtm_campaign=social_mastodon

Abusing Overpermissioned AWS Cognito Identity Pools - Hacking The Cloud

How to take advantage of misconfigured Amazon Cognito Identity Pools.

Hacking the Cloud Feb 24

EC2 user data scripts are meant for bootstrapping instances, but they frequently contain hardcoded credentials and secrets. AWS even warns against this practice since the data has no authentication or encryption protecting it.

If you compromise an EC2 instance, grab the user data immediately via the metadata service. Got IAM access instead? Use describe-instance-attribute to pull it from the API.

https://hackingthe.cloud/aws/general-knowledge/introduction_user_data/?mtm_campaign=social_mastodon

Introduction to User Data - Hacking The Cloud

An introduction to EC2 User Data and how to access it.

Hacking the Cloud Feb 18

Got IAM credentials but want to click around the console instead of memorizing CLI flags? You can convert those creds into a browser session!.

The process differs based on cred type: temporary creds (ASIA...) work directly with "aws-vault login", while long-term creds (AKIA...) require sts:GetFederationToken or sts:AssumeRole first.

Fair warning: this generates a ConsoleLogin event plus suspicious user-agent strings in CloudTrail, so not ideal for stealth.

https://hackingthe.cloud/aws/post_exploitation/create_a_console_session_from_iam_credentials/?mtm_campaign=social_mastodon

Create a Console Session from IAM Credentials - Hacking The Cloud

How to use IAM credentials to create an AWS Console session.