☁️ Vulnerable Cloud Labs & Environments
1. CloudGoat (by Rhino Security Labs)
Purpose-built vulnerable AWS environment.
Deploys via Terraform in your AWS account.
2. Flaws.Cloud (by Scott Piper)
Legendary AWS pentest challenge — step-by-step privilege escalation path.
Teaches real-world misconfig exploitation like EC2 metadata abuse and S3 leaks.
Cloud-focused attack chains using familiar tools like Metasploit.
Built into newer modules in Metasploit Pro and via community plugins.
4. CloudHound (Active Directory + AWS Hybrid Lab)
Designed for hybrid cloud environments:
AWS + on-prem AD + IAM abuse
5. BadBlood + Cloud Combo
Simulate a realistic on-prem Active Directory environment with cloud extensions.
Deploy alongside CloudGoat or Azure vulnerable services for hybrid attack testing.
Post-exploitation framework (like Metasploit for AWS)
Cloud environment auditing and misconfig detection
Security scanning for known misconfigurations
Public S3 bucket discovery
Subdomain and storage brute-force
GCP storage brute-forcing tool
Azure enumeration, secrets discovery
IAM privilege escalation paths
Offensive cloud reconnaissance tool
Tests leaked AWS creds for privilege escalation
🔹 TryHackMe – Cloud Rooms
Interactive and beginner-friendly.
🔹 HackTheBox – Cloud Machines
Realistic cloud-based challenges with AWS and Azure setups.
Some pro labs simulate hybrid environments.
🔹 Pentester Academy Cloud Labs (Now INE)
Hands-on labs in:
Misconfigured S3/EC2/CloudTrail
🔹 Hacking the Cloud Knowledge Base
Comprehensive, attacker-oriented cloud knowledge base with techniques mapped to MITRE ATT&CK.
Great for real-world attack chains.
🧱 Cloud Provider-Specific Pentesting Targets
CloudGoat, flaws.cloud, Pacu
Azucar, MicroBurst, Azure Goat
GCPBucketBrute, gcp_enum, InSecurity by BishopFox
🧠 Cloud Pentesting Learning Path
Pacu, Enumerate-IAM, MicroBurst
S3 exploitation, metadata abuse, SSRF
IAM abuse, Lambda role takeover
STS assume-role, hybrid pivoting
Hidden roles, logging bypass, deleting trails
6. IAM Vulnerable (AWS)
What it is: A focused lab on exploiting IAM misconfigurations in AWS.
7. AWSGoat (by Madhu Akula)
A multi-scenario vulnerable AWS deployment to simulate real-world insecure cloud setups.
Use for:
Pentesting EC2, Lambda, IAM, CloudFormation
Azure’s version of AWSGoat.
Deploy intentionally vulnerable Azure services:
9. GOATStack (Multi-Cloud Lab)
Great for enterprise-level hybrid environment testing.
Enumerates trust policies to find privilege chains
Principal Mapper (principal-mapper)
Maps AWS IAM relationships visually
Use S3 bucket events to trigger reverse shell via Lambda
Bruteforce tool for S3 bucket discovery
Open-source tool to enumerate cloud assets (great for recon)
Enumerate and exploit Microsoft 365 misconfigurations
Privilege escalation and reconnaissance for Azure AD
📦 Real-World Cloud Exploit Repositories
Cloud Security Exploits (by BishopFox)
Active Azure/GCP/AWS attack chains
Red Canary Threat Detection for Cloud
Real telemetry + known bad behavior in cloud
MAD.cloud (MITRE ATT&CK for Cloud)
Mapping of cloud attack techniques to MITRE
Scripts and case studies for Azure and AWS red teaming
GitHub list of up-to-date cloud security and pentest resources
🧬 Hybrid & Federated Cloud Attack Vectors
Cloud pentesting isn’t just about one provider. Many enterprises run hybrid environments. Here are cross-cloud attack chains:
Azure AD → AWS STS AssumeRole
Federated identity configured improperly — Azure user can pivot into AWS
GCP IAM → GKE Compromise → Metadata Theft
Abusing service accounts to elevate
Exploiting misconfigured identity federation
On-prem AD → ADFS → Cloud Control
Attack Active Directory → Abuse federated login to Azure or AWS
Tools like BloodHound for Azure (AzureHound) and CloudFox are great for mapping these hybrid paths.
📚 Deep-Dive Research, Reports & Guidance
MITRE ATT&CK: Cloud Matrix
Official attack tactics for cloud systems
NSA Cloud Security Guidance
Defense + attack surface breakdowns
Deep dives into AWS-specific exploits
Real-world cloud privilege escalation case studies
Google's Cloud Threat Intelligence Team
New GCP attack simulations and telemetry
End-to-end cloud security architecture + exploit scenarios
🧭 Advanced Cloud Pentesting Roadmap (Expert-Level)
Stage
Focus
Tools/Resources
Passive discovery, subdomain enum
cloudlist, amass, CloudBrute
Misconfig abuse, leaked creds
ScoutSuite, CloudFox, Azucar
Misused policies, chaining roles
Enumerate-IAM, MicroBurst
Lambda, Function Apps, GKE abuse
Custom scripts, Pacu modules
Role creation, logging disablement
awscli, azcli, Terraform abuse
Snapshot stealing, S3 dumps
aws s3 cp, GCP gsutil, scripting
💥 Want a Fully-Loaded Cloud Pentest Lab Setup?
I can generate a ready-to-go lab setup with:
✅ AWS: CloudGoat + Pacu + custom scripts
✅ Azure: AzureGoat + MicroBurst
✅ GCP: GCPBucketBrute + simulated misconfigs
✅ Hybrid: Federated SSO misconfig with Okta/ADFS
✅ Monitoring: GuardDuty, CloudTrail, or Sentinel for blue team feedback
Last updated
