Evading Logging in the Cloud: Bypassing AWS CloudTrail
summary
Demonstrates concrete CloudTrail bypasses: changing the Content-Type header from JSON 1.1 to 1.0 hides API calls (over 645 actions across 40 services), undocumented console-exposed APIs (example: iam-admin) proxy IAM operations without CloudTrail entries, and thousands of nonproduction endpoints accept aws CLI endpoint overrides to reach production resources or return responses that never log. Tools and artifacts include enumerate-iam for brute forcing permissions, certificate-transparency monitoring via Sear Spotter to discover endpoints, and an automated scanner plus PoC scripts — many findings were fixed, some nonprod endpoints still remain.
AI-written summary · about
chapters (8)
- 0:00Introduction to AWS CloudTrail
- 2:36Understanding CloudTrail
- 4:38AWS API internals
- 6:46Protocol mutation bypasses
- 9:57Abusing undocumented APIs
- 14:33Nonproduction endpoints
- 20:08Event source obfuscation
- 22:45Finding vulnerabilities
related talks
20mFantastic AWS Attacks and Where to Find Them
31mCloudTrail Logging Internals: Investigating AWS Security Incidents
26mAWS (mis)configuration from an attacker’s-eye view
47mBreaking the Cloud to Rebuild It: A Tale of 3 ☁️ Breaches!
40mBringing a Machete to the Amazon
43mThink like a HACKER
35mAccount Jumping Post Infection Persistency & Lateral Movement in AWS
47mBringing a Machete to the Amazon