SEC588: Cloud Penetration Testing

Cloud penetration testing begins with reconnaissance and discovery. You will understand service provider boundaries, perform internet-scale scanning, and implement asset discovery pipelines, exploring methods for target infrastructure identification, vulnerability discovery, and large-scale reconnaissance strategies that adapt to web-scale environments.

Students assess authentication mechanisms' inherent vulnerabilities, gaining practical experience testing OAuth and OpenIDConnect, discovering authentication bypasses, and executing attacks like app consent phishing. Comprehensive labs emphasize real-world scenarios, covering Microsoft Graph exploitation and identity systems across major cloud platforms.

Advanced privilege escalation and lateral movement techniques are the core of cloud infrastructure testing. Hands-on exercises in AWS and Azure teach students to compromise compute resources and navigate between control and data planes while bypassing common security controls, emphasizing practical exploitation of administrative features and developer tools.

Modern application security testing requires specialized knowledge of serverless functions and container-based microservices. Students explore advanced testing for CI/CD pipelines, infrastructure as code, and cloud-specific injection attacks, engaging in practical exploitation scenarios and understanding complex attack chains in cloud-native environments.

Container breakout techniques and service mesh exploitation provide the foundation for advanced cloud-based operations. Students explore data exfiltration methods and strategies for building attack infrastructure within cloud environments. Labs focus on real-world scenarios, including Kubernetes cluster exploitation and sophisticated evasion techniques.

In a final capstone event, we demonstrate cloud penetration testing's unique demands and the specialized expertise required to go beyond traditional security assessments. Students collaboratively bring their new knowledge to bear on a simulated end-to-end test, reinforcing theory and practice and producing an effective, readable report.