Agent skill · security · aiskillstore
aws-penetration-testing
Provide comprehensive techniques for penetration testing AWS cloud environments. Covers IAM enumeration, privilege escalation, SSRF to metadata endpoint, S3 bucket exploitation, Lambda code extraction, and persistence techniques for red team operations.
Why this skill is useful
Adds executable scripts and specific exploitation techniques for AWS that are not commonly known or documented.
What it needs
Requires pacu, principalmapper, prowler, scoutsuite installed locally. Requires aws account access. About 5k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments. AWS Penetration Testing Purpose Provide comprehensive techniques for penetration testing AWS cloud environments. Covers IAM enumeration, privilege escalation, SSRF to metadata endpoint, S3 bucket exploitation, Lambda code extraction, and persistence techniques for red team operations. Inputs/Prerequisites AWS CLI configured with credentials Valid AWS credentials (even low-privilege) Understanding of AWS IAM model Python 3, boto3 library Tools: Pacu, Prowler, ScoutSuite, SkyArk Outputs/Deliverables IAM privilege escalation paths Extracted credentials and secrets Compromised EC2/Lambda/S3 resources Persistence mechanisms Security audit findings --- Essential Tools Tool Purpose Installation ------ --------- -------------- Pacu AWS exploitation framework git clone https://github.com/RhinoSecurityLabs/pacu SkyArk Shadow Admin discovery Import-Module .\SkyArk.ps1 Prowler Security auditing pip install prowler ScoutSuite Multi-cloud auditing pip install scoutsuite enumerate-iam Permission enumeration git clone https://github.com/andresriancho/enumerate-iam Principal Mapper IAM analysis pip install principalmapper --- Core Workflow Step 1: Initial Enumeration Identify the compromised identity and permissions: Step 2: IAM Enumeration Step 3: Metadata SSRF (EC2) Exploit SSRF to access metadata endpoint (IMDSv1): For IMDSv2 (token required): Fargate Container Credentials: --- Privilege Escalation Techniques Shadow Admin Permissions These permissions are equivalent to administrator: Permission Exploitation ------------ -------------- iam:CreateAccessKey Create keys for admin user iam:CreateLoginProfile Set password for any user iam:AttachUserPolicy Attach admin policy to self iam:PutUserPolicy Add inline admin policy iam:AddUserToGroup Add self to admin group iam:PassRole + ec2:RunInstances Launch EC2 with admin role lambda:UpdateFunctionCod …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/aws-penetration-testing