--- title: "Red Team Archives - Cybr" description: "Every Red Team hands-on lab at Cybr. Practice cloud security skills in real cloud environments you deploy in one click." url: https://cybr.com/hands-on-lab-category/red-team/ --- # Red Team Hands-On Labs 39 labs you deploy in one click and practice in real cloud environments. [Browse all hands-on labs >](https://cybr.com/hands-on-labs/) - ### Azure Key Vault Privilege Escalation View Lab > [Azure Key Vault Privilege Escalation](https://cybr.com/hands-on-labs/lab/azure-key-vault-privilege-escalation/) - ### Breaching Azure Through an Exposed Blob Storage Container View Lab > [Breaching Azure Through an Exposed Blob Storage Container](https://cybr.com/hands-on-labs/lab/breaching-azure-through-an-exposed-blob-storage-container/) - ### Intro to Azure Enumeration View Lab > [Intro to Azure Enumeration](https://cybr.com/hands-on-labs/lab/intro-to-azure-enumeration/) - ### Breaking JWT to Forge an Admin Token View Lab > [Breaking JWT to Forge an Admin Token](https://cybr.com/hands-on-labs/lab/breaking-jwt-to-forge-an-admin-token/) - ### API Gateway Lambda Authorizer Bypass View Lab > [API Gateway Lambda Authorizer Bypass](https://cybr.com/hands-on-labs/lab/api-gateway-lambda-authorizer-bypass/) - ### Hacking WordPress with wp2shell Through a Critical SQLi to RCE View Lab > [Hacking WordPress with wp2shell Through a Critical SQLi to RCE](https://cybr.com/hands-on-labs/lab/hacking-wordpress-with-wp2shell-through-a-critical-sqli-to-rce/) - ### Reduce your AWS attack surface with port scanning View Lab > [Reduce your AWS attack surface with port scanning](https://cybr.com/hands-on-labs/lab/reduce-aws-attack-surface-with-port-scanning/) - ### Bedrock AgentCore Privilege Escalation via Code Interpreters View Lab > [Bedrock AgentCore Privilege Escalation via Code Interpreters](https://cybr.com/hands-on-labs/lab/bedrock-agentcore-privilege-escalation-via-code-interpreters/) - ### Pentesting AWS Lambda with CloudFox View Lab > [Pentesting AWS Lambda with CloudFox](https://cybr.com/hands-on-labs/lab/pentesting-aws-lambda-with-cloudfox/) - ### AWS Lambda Function URL Enumeration and Exploitation View Lab > [AWS Lambda Function URL Enumeration and Exploitation](https://cybr.com/hands-on-labs/lab/aws-lambda-function-url-enumeration-and-exploitation/) - ### Introduction to AWS Lambda Enumeration View Lab > [Introduction to AWS Lambda Enumeration](https://cybr.com/hands-on-labs/lab/introduction-to-aws-lambda-enumeration/) - ### Discover AWS Organization ID via S3 Bucket View Lab > [Discover AWS Organization ID via S3 Bucket](https://cybr.com/hands-on-labs/lab/discover-aws-organization-id-via-s3-bucket/) - ### Discover AWS Account ID via S3 Bucket View Lab > [Discover AWS Account ID via S3 Bucket](https://cybr.com/hands-on-labs/lab/discover-aws-account-id-via-s3-bucket/) - ### Access environment variables via Lambda Function with SSTI View Lab > [Access environment variables via Lambda Function with SSTI](https://cybr.com/hands-on-labs/lab/access-environment-variables-via-lambda-function-with-ssti/) - ### Access Secrets Manager via Lambda Function with LFI View Lab > [Access Secrets Manager via Lambda Function with LFI](https://cybr.com/hands-on-labs/lab/access-secrets-manager-via-lambda-function-with-lfi/) - ### Exploiting Lambda Command Injection to access DynamoDB View Lab > [Exploiting Lambda Command Injection to access DynamoDB](https://cybr.com/hands-on-labs/lab/exploiting-lambda-command-injection-to-access-dynamodb/) - ### Exploiting Lambda SSRF to Access S3 Buckets View Lab > [Exploiting Lambda SSRF to Access S3 Buckets](https://cybr.com/hands-on-labs/lab/exploiting-lambda-ssrf-to-access-s3-buckets/) - ### IAM Challenge – Escape Room View Lab > [IAM Challenge – Escape Room](https://cybr.com/hands-on-labs/lab/iam-challenge-escape-room/) - ### IAM Challenge – Secrets Unleashed View Lab > [IAM Challenge – Secrets Unleashed](https://cybr.com/hands-on-labs/lab/iam-challenge-secrets-unleashed/) - ### S3 ransomware simulation through client-side encryption View Lab > [S3 ransomware simulation through client-side encryption](https://cybr.com/hands-on-labs/lab/s3-ransomware-simulation-through-client-side-encryption/) - ### S3 ransomware simulation through batch file deletion View Lab > [S3 ransomware simulation through batch file deletion](https://cybr.com/hands-on-labs/lab/s3-ransomware-simulation-through-batch-file-deletion/) - ### Backdoor an S3 Bucket via its Bucket Policy View Lab > [Backdoor an S3 Bucket via its Bucket Policy](https://cybr.com/hands-on-labs/lab/backdoor-an-s3-bucket-via-its-bucket-policy/) - ### Compromising EC2 IMDSv2 with RCE to Access Sensitive S3 Data View Lab > [Compromising EC2 IMDSv2 with RCE to Access Sensitive S3 Data](https://cybr.com/hands-on-labs/lab/compromising-ec2-imdsv2-with-rce-to-access-sensitive-s3-data/) - ### IAM PutRolePolicy PrivEsc View Lab > [IAM PutRolePolicy PrivEsc](https://cybr.com/hands-on-labs/lab/iam-putrolepolicy-privesc/) - ### IAM AttachRolePolicy PrivEsc View Lab > [IAM AttachRolePolicy PrivEsc](https://cybr.com/hands-on-labs/lab/iam-attachrolepolicy-privesc/) - ### IAM PutGroupPolicy PrivEsc View Lab > [IAM PutGroupPolicy PrivEsc](https://cybr.com/hands-on-labs/lab/iam-putgrouppolicy-privesc/) - ### IAM PutUserPolicy PrivEsc View Lab > [IAM PutUserPolicy PrivEsc](https://cybr.com/hands-on-labs/lab/iam-putuserpolicy-privesc/) - ### IAM AttachGroupPolicy PrivEsc View Lab > [IAM AttachGroupPolicy PrivEsc](https://cybr.com/hands-on-labs/lab/iam-attachgrouppolicy-privesc/) - ### IAM AttachUserPolicy PrivEsc View Lab > [IAM AttachUserPolicy PrivEsc](https://cybr.com/hands-on-labs/lab/iam-attachuserpolicy-privesc/) - ### IAM AddUserToGroup PrivEsc View Lab > [IAM AddUserToGroup PrivEsc](https://cybr.com/hands-on-labs/lab/iam-addusertogroup-privesc/) - ### IAM UpdateLoginProfile PrivEsc View Lab > [IAM UpdateLoginProfile PrivEsc](https://cybr.com/hands-on-labs/lab/iam-updateloginprofile-privesc/) - ### IAM CreateLoginProfile PrivEsc View Lab > [IAM CreateLoginProfile PrivEsc](https://cybr.com/hands-on-labs/lab/iam-createloginprofile-privesc/) - ### IAM CreateAccessKey PrivEsc View Lab > [IAM CreateAccessKey PrivEsc](https://cybr.com/hands-on-labs/lab/iam-createaccesskey-privesc/) - ### Lambda SQL injection to access secrets View Lab > [Lambda SQL injection to access secrets](https://cybr.com/hands-on-labs/lab/lambda-sql-injection-to-access-secrets/) - ### Privilege Escalation via IAM Versions View Lab > [Privilege Escalation via IAM Versions](https://cybr.com/hands-on-labs/lab/privilege-escalation-via-iam-versions/) - ### S3 Data Exfiltration via EC2 IMDSv1 View Lab > [S3 Data Exfiltration via EC2 IMDSv1](https://cybr.com/hands-on-labs/lab/s3-data-exfiltration-via-ec2-imdsv1/) - ### Introduction to S3 Enumeration View Lab > [Introduction to S3 Enumeration](https://cybr.com/hands-on-labs/lab/introduction-to-s3-enumeration/) - ### Introduction to Secrets Manager Enumeration View Lab > [Introduction to Secrets Manager Enumeration](https://cybr.com/hands-on-labs/lab/introduction-to-secrets-manager-enumeration/) - ### Introduction to AWS IAM Enumeration View Lab > [Introduction to AWS IAM Enumeration](https://cybr.com/hands-on-labs/lab/introduction-to-aws-iam-enumeration/) [See every hands-on lab, in every category >](https://cybr.com/hands-on-labs/)