All Articles & Walkthroughs

Identifying the AWS Account ID from a Public S3 Bucket is a PwnedLabs beginner lab that focuses on discovering and attributing AWS cloud assets from public web footprinting. Initial reconnaissance of the IP address identifies an Apache web server referencing image assets stored in an Amazon S3 bucket named mega-big-tech. Querying the root bucket URL confirms unauthenticated s3:ListBucket and s3:GetObject permissions. Using the open-source tool s3-account-search alongside a controlled IAM role, condition-key policy evaluation was performed against the public bucket. Sequential digit-by-digit prefix probing isolated the target AWS Account ID as 107513503799, establishing the account boundary required for subsequent cloud security auditing.

Breach in the Cloud is a PwnedLabs beginner lab that features an AWS incident response lab that begins with analysing compromised access keys belonging to temp-user. Inspecting the inline IAM policy test-temp-user reveals permission to execute sts:AssumeRole targeting AdminRole. Although assuming the role provides temporary elevated session credentials, global bucket enumeration is restricted by policy boundaries. Parsing CloudTrail log entries using jq isolates extensive automated IAM discovery and tracks an attacker session. Querying ListObjects and GetObject log entries identifies direct API targeting of the emergency-data-recovery S3 bucket. Re-evaluating CLI access against the specific bucket path bypasses global listing limits, permitting retrieval of emergency.txt and message.txt to confirm data exfiltration and complete the forensic investigation.