Cloud Security
Index of cloud CTF pages - metadata abuse, bucket misconfigurations, IAM escalation, Kubernetes basics, and CI/CD secret leaks.
Cloud Security
Cloud challenges in CTFs combine web exploitation, OSINT, and infrastructure misconfigurations. Instead of a single memory bug, you chain multiple misconfigurations — exposed metadata, weak IAM permissions, public buckets, and leaked deployment secrets — to reach the flag.
The attack surface is broad but the methodology is consistent: enumerate what's exposed, find credentials, escalate permissions, read the flag.
Pages in This Section
| Page | Difficulty | Description |
|---|---|---|
| AWS Metadata (IMDS) | Intermediate | Steal temporary credentials via the instance metadata service |
| S3 Misconfiguration | Beginner | Public buckets, listing mistakes, and object leaks |
| IAM Privilege Escalation | Advanced | Escalate AWS roles via dangerous IAM permissions |
| Kubernetes Basics | Intermediate | Pods, service accounts, RBAC, and common cluster mistakes |
| Secrets in CI/CD | Intermediate | Tokens in logs, build artifacts, and deployment configs |
Common Cloud Attack Chains
Methodology
Enumerate Exposed Assets
Buckets, APIs, domains, repos, image registries. Public metadata in web responses or error messages. Start broad — anything internet-facing.
Identify Trust Boundaries
Who can assume what role? Which service can read which secret? Is the internal metadata service reachable via SSRF?
Look for Leaked Credentials
.env, CI logs, backup archives, Docker layer history, git commits. Temporary tokens from metadata endpoints expire — grab them fast.
Escalate Permissions
sts:AssumeRole abuse, iam:PassRole chains, Kubernetes service account token pivot to cloud IAM.
Attack Routes by Entry Point
Path: Vulnerable URL fetch → IMDS → AWS credentials → IAM escalation
- AWS Metadata (IMDS) — steal temporary creds via
169.254.169.254 - IAM Privilege Escalation — escalate from limited role
- S3 Misconfiguration — find the flag in a bucket
curl http://target/fetch?url=http://169.254.169.254/latest/meta-data/High-Value Attack Routes
Tools Quick Reference
# AWS
aws sts get-caller-identity
aws s3 ls s3://target-bucket --no-sign-request
aws iam simulate-principal-policy ...
# Kubernetes
kubectl auth can-i --list
kubectl get secrets -A -o yaml
# Secret scanning
trufflehog filesystem .
rg "AWS_|SECRET|TOKEN|PASSWORD|BEGIN RSA"
# Metadata probe
curl -s http://169.254.169.254/latest/meta-data/Last updated on