A public S3 bucket exposed credentials that led to IAM abuse, DynamoDB data exfiltration, cracked passwords, and successful AWS Console access via credential stuffing.

A public git repository exposes an Android app's source code, revealing misconfigured Cognito pools. Chaining unauthenticated access, user creation, and Lambda SSRF leads to credential extraction and complete AWS compromise of Huge Logistics' cloud environment.

Compromised SSH credentials provide access to a web server. Discovering a publicly writable S3 bucket hosting frontend assets, we inject malicious JavaScript to steal admin session cookies via XHR requests, achieving session hijacking and accessing sensitive exported data.

A public Docker image exposes AWS credentials in environment variables. Enumerating CodeCommit with these credentials reveals a dev branch containing hardcoded keys in source code, granting access to an S3 bucket with sensitive data.

Leaked AWS keys enabled API Gateway policy abuse, removal of a prod IP restriction, redeployment, and unauthorized access to the production endpoint.

AWS credentials expose S3 buckets with SSH keys and EC2 password access. Pivoting via WinRM uncovers credentials leading to AD backups containing NTDS.dit and domain password hashes.

An exposed config.json file reveals AWS credentials, leading to enumeration of Secrets Manager. By extracting credentials, accessing CloudShell, and exploiting IAM role assumptions with an External ID, we escalate privileges to retrieve Huge Logistics' default payment card details.

An exposed RDS MySQL instance is discovered through port scanning. Using Metasploit to brute-force credentials, we gain database access revealing weak passwords and unencrypted PII including customer names, emails, passwords, and credit card numbers stored in plaintext.

Using only an AWS account ID, we enumerate public RDS snapshots to discover an exposed Aurora PostgreSQL cluster. By restoring the snapshot, resetting credentials, and accessing via EC2, we extract customer PII including usernames, passwords, and credit card numbers.

Compromised AWS credentials reveal S3 bucket permissions. By modifying S3 replication policies and batch operations, we exfiltrate data to an attacker-controlled bucket. Discovered credentials in the replicated data lead to Secrets Manager access, exposing AWS Organization root account credentials.