Agent skill · security · davila7
AWS Penetration Testing
This skill should be used when the user asks to "pentest AWS", "test AWS security", "enumerate IAM", "exploit cloud infrastructure", "AWS privilege escalation", "S3 bucket testing", "metadata SSRF", "Lambda exploitation", or needs guidance on Amazon Web Services security assessment.
Why this skill is useful
Adds executable scripts and specific exploitation techniques for AWS security assessments that are not widely known.
What it needs
Requires git, pip installed locally. Requires aws account access. About 5k tokens when loaded. Last updated 2026-08-06. 30,138 stars on the source repository.
What this skill does
AWS Penetration Testing Purpose Provide comprehensive techniques for penetration testing AWS cloud environments. Covers IAM enumeration, privilege escalation, SSRF to metadata endpoint, S3 bucket exploitation, Lambda code extraction, and persistence techniques for red team operations. Inputs/Prerequisites AWS CLI configured with credentials Valid AWS credentials (even low-privilege) Understanding of AWS IAM model Python 3, boto3 library Tools: Pacu, Prowler, ScoutSuite, SkyArk Outputs/Deliverables IAM privilege escalation paths Extracted credentials and secrets Compromised EC2/Lambda/S3 resources Persistence mechanisms Security audit findings --- Essential Tools Tool Purpose Installation ------ --------- -------------- Pacu AWS exploitation framework git clone https://github.com/RhinoSecurityLabs/pacu SkyArk Shadow Admin discovery Import-Module .\SkyArk.ps1 Prowler Security auditing pip install prowler ScoutSuite Multi-cloud auditing pip install scoutsuite enumerate-iam Permission enumeration git clone https://github.com/andresriancho/enumerate-iam Principal Mapper IAM analysis pip install principalmapper --- Core Workflow Step 1: Initial Enumeration Identify the compromised identity and permissions: Step 2: IAM Enumeration Step 3: Metadata SSRF (EC2) Exploit SSRF to access metadata endpoint (IMDSv1): For IMDSv2 (token required): Fargate Container Credentials: --- Privilege Escalation Techniques Shadow Admin Permissions These permissions are equivalent to administrator: Permission Exploitation ------------ -------------- iam:CreateAccessKey Create keys for admin user iam:CreateLoginProfile Set password for any user iam:AttachUserPolicy Attach admin policy to self iam:PutUserPolicy Add inline admin policy iam:AddUserToGroup Add self to admin group iam:PassRole + ec2:RunInstances Launch EC2 with admin role lambda:UpdateFunctionCode Inject code into Lambda Create Access Key for Another User Attach Admin Policy Add Inline Admin Policy Lambda Privilege Escalation --- S3 …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills davila7/aws-penetration-testing