Nice one!
Free Hands-On Lab
Backdoor an S3 Bucket via its Bucket Policy
Using Stratus Red Team, an automated red teaming tool, backdoor an S3 bucket by updating its Bucket Policy to allow access from an external AWS account. This method allows an attacker to access and exfiltrate S3 data, even if the compromised access key is deleted.
Free hands-on lab
Launch this lab with a free account
Build practical, real-world skills in a cloud environment.
- Real cloud environments, not simulations
- One click to deploy, nothing to install
- We cover the cloud costs and risks so you can focus on learning
4 comments
Instructor
Thanks!
Hey ! I’m havinf a hard time to understand what’s the use to give us permission on a S3 bucket we created… Is it possible to not do the warm up and to directly do it on an existant S3 bucket ?
Instructor
Hey, Stratus Red Team creates its own separate resources on purpose, so that you don’t affect existing resources in your environments. It’s fully self contained and doesn’t have external resource requirements. You could do the same on existing resources by writing your own attack scripts, but that defeats the purpose of this tool. The warm up for this particular scenario just creates a new S3 bucket to perform the attack against. The detonation will then create and attach a bucket policy that grants access to an external AWS account that’s outside of your control (attacker-controlled). This simulates a backdoored bucket policy, since it will grant access to all the objects within it to the attacker. I would suggest taking a few steps back and learning more about Amazon S3 and how it works before moving on to attacks like this, and we have a full course on this to help.
Comments are currently read-only while we migrate to our new platform. In the meantime, ask questions in Discord.