Web-to-Cloud Attack Chains

Phase 2 — Web-to-Cloud Attack Chains

This phase is especially useful because it directly connects web pentesting with cloud security operations.

Learning Objectives

• Chain web vulnerabilities into cloud access paths.
• Understand how temporary or leaked credentials are obtained and abused.
• Practice secret discovery across repositories, build artifacts, and container images.
• Learn practical impact: pivoting from initial web access into AWS resource compromise.
• Build stronger detection and prevention mindset for web-to-cloud attack chains.

Lab Path

Order	Lab	Type	Summary
7	SSRF to Pwned	🔴 Red	SSRF against an EC2-hosted application to reach metadata service and extract temporary AWS credentials.
8	Path Traversal to AWS credentials to S3	🔴 Red	Use path traversal to recover AWS credentials, then pivot to S3 access.
9	Hunt for Secrets in Git Repos	🔴 Red	Identify leaked credentials and sensitive tokens in Git repositories.
10	Uncover Secrets in CodeCommit and Docker	🔴 Red	Discover exposed credentials stored in AWS CodeCommit history and Docker images.
11	Leverage Leaked Credentials for Pwnage	🔴 Red	Operationalize leaked secrets to access cloud resources and extract sensitive data.
12	Access Secrets with S3 Bucket Versioning	🔴 Red	Use S3 object versioning to recover historical secrets and plaintext sensitive fields.

Key Knowledge After Phase 2

1. Web bugs can become cloud compromise vectors when they expose metadata services, local files, or credentials.
2. Credential exposure is the core pivot point across repos, containers, and misconfigured storage.
3. Temporary credentials are still dangerous if not tightly scoped and monitored.
4. Attack chains matter more than single findings, because small web issues can escalate into full cloud impact.
5. Prevention requires layered controls: secure coding, secret hygiene, least privilege IAM, and continuous monitoring.