Use session policy denials and verbose IAM error messages to determine if AWS resources have public resource-based policies.

How to abuse AWS Organizations' default behavior and lateral movement capabilities.

Knowing only the name of a public S3 bucket, you can ascertain the account ID it resides in.

Obtain persistence by creating a rogue OIDC Identity Provider.

Utilise Azure RunCommands for execution and lateral movement.

An in-depth explanation of how to still abuse CVE-2024-28056, a vulnerability in AWS Amplify that exposed IAM roles to takeover.

Override the default botocore user-agent string in boto3 to prevent GuardDuty PenTest findings from firing.

With access to an EC2 instance you can intercept, modify, and spoof SSM communications.

A collection of tips and tricks for using the AWS CLI.

How to convert an unique identifier to a principal ARN.

Keep your access by chaining assume-role calls.

Abuse IAM's eventual consistency to maintain persistence against incident response containment.

Use session policy denials and verbose IAM error messages to determine if AWS resources have public resource-based policies.

Google Workspace Apps Script projects create hidden GCP projects (sys-<...>) that can be impersonated by attackers. This technique enables stealthy persistence (service accounts, hidden compute,…

During research, we sometimes encounter scenarios that remind us that it's a good idea to trust but verify. In September 2025, we noticed that certain Microsoft Copilot Studio agent settings did not…

With access to an ec2 instance, you will be able to identify the AWS account it runs in.

Discover how to exploit information disclosure configurations in Azure Active Directory to enumerate valid email addresses.

How to take advantage of misconfigured Amazon Cognito Identity Pools.

An introduction to EC2 User Data and how to access it.

How to use IAM credentials to create an AWS Console session.

Break out of a Cloud Workstations container through an exposed Docker socket, then access project credentials from instance metadata.

Convert access to the AWS Console into IAM credentials.

How to find and take advantage of exposed EBS snapshots.

Brute force the IAM permissions of a user or role to see what you have access to.

Hacking the Cloud is opening the door to AI and LLM security research.

How to find valid and invalid GCP Buckets using tools

Bypass AWS Network Firewall Egress Filtering using SNI spoofing and Host Header manipulation.

How Anthropic's refusal test string can be abused to stop streaming responses and create sticky failures.

Discover how to identify and exploit misconfigured AWS IAM roles using GitLab OIDC, with a detailed, step-by-step guide.

Discover how to exploit cross-account behaviors to enumerate IAM users and roles in another AWS account without authentication.

How to take advantage of misconfigured role trust policies that have wildcard principals.

Leverage a default configuration in Terraform Enterprise to steal credentials from the Metadata Service

An end of year summary for Hacking the Cloud in 2025.

Abuse security group connection tracking to maintain persistence even when security group rules are changed.

An AWS/GitLab CICD themed CTF.

Connect to the Tor network from an EC2 instance without alerting GuardDuty.

Abuse IAM's eventual consistency to maintain persistence against incident response containment.

Leverage file read and SSRF vulnerabilities to steam IAM credentials and event data from Lambda.

How to find public AMIs and get stored secrets.