Intro
Welcome Dear listeners, I’m Viktor your host and as a weekly basis I will share news, articles, techniques, tools that is related to Cloud, SaaS, IaaC security.
News
ChaosDB – https://www.wiz.io/blog/chaosdb-how-we-hacked-thousands-of-azure-customers-databases
How to contact Google SRE: Dropping a shell in cloud SQL – https://offensi.com/2020/08/18/how-to-contact-google-sre-dropping-a-shell-in-cloud-sql/
EC2 IPV6 – https://twitter.com/0xdabbad00/status/1430597907057549315
BHUSA 2021 – Cloud with a Chance of APT https://www.slideshare.net/DouglasBienstock/bhusa-2021-cloud-with-a-chance-of-apt
The last S3 security document that we’ll ever need, and how to use it by Trustoncloud – https://trustoncloud.com/the-last-s3-security-document-that-well-ever-need/
Attacking Azure and Azure AD Part 2 – https://posts.specterops.io/attacking-azure-azure-ad-part-ii-5f336f36697d
Illogical Apps – https://www.netspi.com/blog/technical/cloud-penetration-testing/illogical-apps-exploring-exploiting-azure-logic-apps/
Cloud Security Orienting – https://tldrsec.com/blog/cloud-security-orienteering/
AWS ReadOnlyAccess – https://posts.specterops.io/aws-readonlyaccess-not-even-once-ffbceb9fc908
EC2 Global View – https://twitter.com/jamesoff/status/1431289712896000000
AWS Access Denied Error Message Changes- https://aws.amazon.com/blogs/security/aws-introduces-changes-to-access-denied-errors-for-easier-permissions-troubleshooting/
Controlling outbound traffic from Kubernetes – https://monzo.com/blog/controlling-outbound-traffic-from-kubernetes
Microsoft 365 AUDIT LOGGING – https://zolder.io/office-365-audit-logging/
Divinetechygirl – https://twitter.com/divinetechygirl/status/1430217626148556801
Spoofing Azure AD sign-ins logs by imitating AD FS Hybrid Health Agent –https://o365blog.com/post/hybridhealthagent/
Privilege Escalation in Azure AD Applications – https://emptydc.com/2020/12/10/privilege-escalation-in-azure-ad/
Tools
- Prowler
- Kubescape
- AzureADIncidentResponse
- CloudLAPS
- Cloud Katana
Outro
That’s all for this episode. Thank you for listening and have a secure day!