Live Hacking Cloud Architectures
summary
A live attack chains DNS brute forcing and Metasploit-based credential spraying against Jenkins, obtains Jenkins admin via brute force, extracts an encrypted secret from the script console, decodes a GCP service account and uses gcloud to access GKE; Octant and kubectl reveal namespaces and a root shell inside a container, then the adversary pulls 300 MB database backup downloaded and infrastructure-as-code buckets. Defenses demonstrated: eBPF/Tetragon, Cilium, Falco, CSPM and least-privilege to prevent GCP service account leaked.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:27Cloud security importance
- 4:18Four phases of cyber attack
- 6:02Cloud attack scenario setup
- 7:08DNS reconnaissance
- 9:57Exposed Jenkins instance
- 12:07Brute-forcing Jenkins
- 18:07Accessing Jenkins dashboard
- 20:03Extracting cloud credentials
- 24:47Authenticating to Google Cloud Platform
- 25:33Exploring Kubernetes clusters
- 28:25Downloading backups
- 30:17Root access achieved
- 32:23Attack vectors and persistence
- 33:04Defensive strategies
- 35:19Q&A
