skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

conducting-cloud-penetration-testing

Guides authorized penetration testing of AWS, Azure, and GCP environments using Pacu, ScoutSuite, and MITRE ATT&CK mapping.

954|172|Updated Mar 13, 2026
Search Tags:#AWS#pacu#SSRF#mitre att&ck#offensive security#cloud pentesting#iam privilege escalation
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill conducting-cloud-penetration-testing
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: conducting-cloud-penetration-testing
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/cloud-security/conducting-cloud-penetration-testing
Command: npx skills add https://github.com/xalgord/xalgorix --skill conducting-cloud-penetration-testing

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Cloud security assessments often miss critical attack paths like IAM privilege escalation chains, SSRF-to-metadata credential theft, and cross-account lateral movement, leaving organizations with incomplete pictures of their actual cloud risk.

Core Features & Use Cases

  • Structured Cloud Pentest Workflow: Seven-step methodology covering scoping under the shared responsibility model, reconnaissance, IAM privilege escalation, SSRF-to-IMDS exploitation, lateral movement, persistence testing, and reporting.
  • Tool-Specific Guidance: Concrete commands for Pacu, ScoutSuite, Prowler, and CloudFox across AWS, Azure, and GCP, including IMDSv1/v2 testing and cross-account role assumption checks.
  • MITRE ATT&CK Cloud Reporting: Findings template that maps each issue to ATT&CK tactics with severity, proof of concept, and remediation guidance.
  • Use Case: A security consultant with read-only developer credentials in a client's AWS account uses this workflow to enumerate permissions with Pacu, discover an iam:CreatePolicyVersion escalation path, and document the full chain to administrative access in an ATT&CK-mapped report.

Quick Start

Ask the AI to plan and execute an authorized penetration test of your AWS account, starting from low-privilege credentials and reporting findings mapped to the MITRE ATT&CK Cloud matrix.

Frequently Asked Questions about conducting-cloud-penetration-testing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a penetration test on an AWS account?▼

Start with written authorization and a scope document based on the shared responsibility model, then enumerate the attack surface with ScoutSuite, Prowler, and CloudFox. Use Pacu modules like iam__privesc_scan to find privilege escalation paths, and report findings mapped to the MITRE ATT&CK Cloud matrix.

What tools are used for cloud penetration testing?▼

Pacu handles AWS exploitation and IAM privilege escalation, ScoutSuite audits AWS, Azure, and GCP configurations, Prowler runs 300+ security checks, and CloudFox identifies attack paths and data access opportunities. Cartography maps resource relationships in Neo4j for attack path analysis.

How do I test SSRF against the AWS metadata service?▼

Test both IMDSv1 with a direct GET to 169.254.169.254/latest/meta-data/iam/security-credentials/ and IMDSv2 by first requesting a token via PUT. Also check the HttpPutResponseHopLimit, since values above 1 can expose IMDSv2 to containerized or SSRF contexts.

Does AWS require approval before penetration testing?▼

AWS no longer requires pre-approval for most services, but you still need written authorization from the account owner and a defined scope. DDoS simulation and testing of cloud provider infrastructure itself remain prohibited under the shared responsibility model.

What are the limitations of cloud penetration testing?▼

Testing cannot target cloud provider infrastructure, hypervisors, or managed service internals, which remain the provider's responsibility. Volumetric DDoS testing requires explicit provider approval, and IAM eventual consistency means denied actions should be retried before ruling out access.

Related Skills

Explore More Software Engineering Skills→
Kisilev13Kisilev13

cloud-iam-deep

Enumerate AWS, Azure, and GCP IAM configurations for credential exploitation vulnerabilities.

Community
Advanced
maruakshaymaruakshay
4

system-infrastructure-security

Identify and remediate insecure AI infrastructure configurations across cloud and self-hosted deployments.

Community
Advanced
balsm-healthbalsm-health
2

implementing-cloud-security-posture-management

Automate continuous security posture monitoring across AWS, Azure, and GCP.

Official
Advanced
BrunoSantanaDeveloperBrunoSantanaDeveloper

red-team-tactics

Automate adversary-simulation planning and reporting with MITRE ATT&CK tactics.

Community
Advanced