Elevator Pitch
A 2-day Hands-on training on Cloud Penetration Testing for Amazon Web Services (AWS) and Microsoft Azure, including a Capture the Flag (CTF) event to give attendees the opportunity to practice their skills on their own.
Description
The training covers a range of topics, including vulnerability assessment, misconfiguration identification, and exploitation techniques. Attendees will learn about cloud security best practices and will have the opportunity to practice identifying and exploiting vulnerabilities in cloud environments. The CTF event will allow attendees to apply their knowledge and skills in a hands-on setting, giving them valuable experience in cloud penetration testing. By the end of the course, attendees will be able to conduct comprehensive cloud penetration tests and provide recommendations for improving the security of cloud-based systems.
Key takeaways from the training include an understanding of cloud security best practices, the ability to identify and exploit vulnerabilities in cloud environments, and the skills to implement secure configurations in the cloud. Don't miss this opportunity to enhance your cloud security skills and join the Tools watch Academy for this exciting training, including the CTF event.
Day 1: 1. Introduction to Cloud pen testing o Definition and purpose of Cloud pen testing o Differences between traditional pen testing and Cloud pen testing o Key considerations for Cloud pen testing (such as scope, permissions, and legal implications) 2. Overview of AWS and Azure o Introduction to the two major Cloud providers: AWS and Azure o Overview of the different services and offerings provided by each provider 3. Identifying and enumerating Cloud resources o Techniques for discovering and mapping out Cloud resources, such as: ➢ Scanning for open ports and services ➢ Enumerating Cloud metadata and APIs ➢ Using open-source intelligence (OSINT) techniques ➢ IAM misconfiguration ➢ Service misconfiguration ▪ S3 ▪ EC2 ▪ Lambada Function o Tools and techniques for automating resource discovery and enumeration 4. Testing for vulnerabilities in Cloud infrastructure and applications o Overview of common vulnerabilities and attack vectors in Cloud environments o Techniques for testing for vulnerabilities, such as: ▪ Performing network and port scans ▪ Using tools and frameworks for testing Cloud security 5. Automating Vulnerability Assessment testing using AWS CLI and Python
2: 1. Exploiting vulnerabilities and gaining access to Cloud resources • Techniques for exploiting vulnerabilities and gaining unauthorized access to Cloud resources, such as: o Using known vulnerabilities and exploits o Brute forcing passwords and keys o exploiting misconfiguration on services • Techniques for maintaining access and establishing persistence in Cloud environments o Disabling security controls and monitoring mechanisms o Creating backdoors or other means of re-entry in case their initial access is detected and blocked o Installing persistent malware or rootkits o Modifying system or configuration files to ensure that their access remains even after a restart o Creating scheduled tasks or cron jobs to run their malicious code on a regular basis • The importance of proper clean-up and post-exploitation activities o Remove all traces of the attack o Monitor for future attacks 2. Best practices for securing Cloud environments • Overview of best practices for secure Cloud deployment and operation • Strategies for implementing least privilege, network segmentation, and other security controls in Cloud environments • Techniques for monitoring and detecting security threats in Cloud environments 3. Advanced Cloud pen testing techniques • Attacking hybrid Cloud environments • Attacking Cloud-based applications • Attacking Cloud-based storage • Attacking Cloud-based networking 4. Conclusion and next steps for learning more about Cloud pen testing • Summary of key takeaways from the workshop • Recommendations for further learning and resources for staying up to date on Cloud pen testing best practices and techniques
Key takeaway for Attendees: • Understanding of the purpose and importance of Cloud pen testing: Attendees will learn why it is important to test the security of Cloud environments and how Cloud pen testing differs from traditional pen testing. • Knowledge of key concepts and best practices in Cloud security: Attendees will learn about key security concepts and best practices for securing Cloud environments, such as least privilege, network segmentation, and monitoring. • Familiarity with the major Cloud providers (AWS and Azure) and their security models: Attendees will learn about the security models and offerings of the two major Cloud providers, AWS and Azure, and how to identify and enumerate resources in these environments. • Ability to identify and enumerate Cloud resources: Attendees will learn techniques for discovering and mapping out Cloud resources, such as using scanning tools and open-source intelligence (OSINT) techniques. • Skills in testing for vulnerabilities in Cloud infrastructure and applications: Attendees will learn how to test for vulnerabilities in Cloud environments, including how to perform security assessments, penetration tests, and use tools and frameworks for testing Cloud security. • Techniques for exploiting vulnerabilities and gaining unauthorized access to Cloud resources: Attendees will learn how to exploit vulnerabilities and gain unauthorized access to Cloud resources, including using known vulnerabilities and exploits, brute forcing passwords and keys, and using social engineering techniques. • Best practices for securing Cloud environments: Attendees will learn about best practices for secure Cloud deployment and operation, including strategies for implementing security controls and monitoring for threats. • Understanding of advanced Cloud pen testing techniques: Attendees will learn about advanced techniques for attacking Cloud environments, such as attacking hybrid Cloud environments, Cloudbased applications, and Cloud-based storage. • Recommendations for further learning and resources: Attendees will receive recommendations for additional learning resources and ways to stay up to date on Cloud pen testing best practices and techniques.