Offensive security assessments
AWS
We validate this area during scoped assessments, documenting impact and remediation guidance.
Why it matters
1. Asset Discovery - Use to list AWS resources: 2. DNS Enumeration - Use dig or nslookup to enumerate DNS records:
How we test it
Our operators follow a structured checklist for this topic, adapted to your API surface and authentication model.
Testing approach
- Review IAM policies and roles using AWS Management Console or :
- Assess VPC configurations and subnets:
- Review S3 bucket permissions:
- Assess EC2 instance configurations and security groups:
- Identify and enumerate AWS resources.
- Tools: AWS Management Console, , AWS Asset Inventory
- Enumerate DNS records for AWS-related domains.
- Tools: dig, nslookup
What we look for
- Review IAM policies and roles using AWS Management Console or :
- Assess VPC configurations and subnets:
- Review S3 bucket permissions:
- Assess EC2 instance configurations and security groups:
- Identify and enumerate AWS resources.
- Tools: AWS Management Console, , AWS Asset Inventory
- Enumerate DNS records for AWS-related domains.
- Tools: dig, nslookup
Related topics
| Topic | Summary |
|---|---|
| Azure | We validate this area during scoped assessments, documenting impact and remediation guidance. |
| GCP | We validate this area during scoped assessments, documenting impact and remediation guidance. |
| Subdomain Takeover | A subdomain takeover happens when a DNS record (usually a CNAME, sometimes A/NS) still points to a cloud service or external provider that is no longer claimed. An attacker registers the dangling resource on that provider and serves their own content from the victim's subdomain,… |