Hacking the Cloud @HackingthCloud
The official Twitter account for Hacking the Cloud, the open-source encyclopedia of offensive security techniques in the cloud. Created by @frichette_n hackingthe.cloud Your Cloud Joined February 2024-
Tweets103
-
Followers224
-
Following1
-
Likes40
Cloud attackers keep evolving. So should defenses. Enumeration through AWS Resource Explorer used to be invisible. Not anymore. Breakdown from @datadoghq: securitylabs.datadoghq.com/articles/enume…
It’s a month and a half away but I’m already super excited for @fwdcloudsec EU! If you’ll be there in Berlin, come find me for limited edition, holographic, @HackingthCloud stickers!
Safe travels to everyone coming to @fwdcloudsec! It’s the densest concentration of cloud security nerds in the world!
There is a lot wrong with what happened here, but I’ll complain about the parts in my wheel house. Exposing access keys via an API?! Having logs go to a bucket that could be claimed by anyone?! AHHHH We still have so far to go with cloud security. specterops.io/blog/2025/06/1…
If you're heading to fwd:cloudsec in a few weeks, we are teaming up with our friends at @tamnoon_io to host Arcade & Apps. What's better than pizza and arcade games after a long day of conferencing? Space is limited, so reserve your spot by signing up! tamnoon.io/fwd-cloudsec-n…
If you're looking for a sts:GetCallerIdentity replacement that doesn't log to CloudTrail, I've added a few more APIs that don't log and don't have support for additional logging with Data events. Perfect for a quiet `whoami` in the AWS control plane. hackingthe.cloud/aws/enumeratio…
Why does AWS Amplify not use CodeConnections? The latter is a nice way to set up integration with GitHub once and share it across a whole org - except for Amplify 🫠 Is it due to Amplify having extra functionality, maybe?
A little over a year ago I published research on how you could leverage non-production AWS API endpoints to enumerate permissions without logging to CloudTrail. A year later...I'm still finding them. Red Teamers, these can be super useful and really up your game!
🤩 I just came across this fascinating talk by @Frichette_n at fwd:cloudsec: “Hidden Among the Cloud: A Look at Undocumented AWS APIs.” youtube.com/watch?v=f7AuDx…
New on Hacking the Cloud! Tired of well-known enumeration strategies that could get you caught? Why not think outside the box? This article covers enumeration of resources using the AWS Backup service. I have related research on this topic coming soon! hackingthe.cloud/aws/enumeratio…
👾 It's up!! Everything you ever wanted to know about Entra Administrative Unit attack paths, from my talk at @SpecterOps SO-CON: youtube.com/watch?v=oxD7-U…
Want to learn more about Administrative Unit attack paths in Azure? Check out @_sigil's talk about it from @SpecterOps Con! youtube.com/watch?v=oxD7-U…
New on Hacking the Cloud! Did you know that IAM roles can’t be recreated? Even if their ARNs are identical? This can cause a major problem if you delete an IAM role used in SaaS trust relationships 😬 hackingthe.cloud/aws/general-kn…
🚨 New on Hacking the Cloud: Discover how misconfigured tagBindings.create permissions in GCP can lead to privilege escalation. Learn how attackers can exploit tags to gain elevated access. Stay informed and secure your cloud infrastructure. Read more: hackingthe.cloud/gcp/exploitati…
Something I'm really proud of: I made it to the number 1 spot on the AWS Vulnerability Disclosure Program Leaderboard! I'm excited to continue helping improve AWS' security posture and help root out categories of vulnerability in AWS services/technologies! hackerone.com/aws_vdp/thanks
publicly accessible endpoints and get them shut down, closing this attack path for adversaries. Today the first report has been publicly disclosed with many more on the way. We're continuing to make it difficult for adversaries to abuse these techniques :) hackerone.com/reports/2981210
Last May we shared our research on using AWS non-production endpoints for a variety of attack scenarios against AWS environments. These endpoints are easy to find and provide options for an adversary to evade detection. More recently, we have partnered with AWS to find 1/x
Hacking the Cloud was down for ~53 minutes due TLS cert shenanigans. We are back up and running again! Thank you for your patience ❤️ Now get out there and hack some cloud environments!
Big thanks to @Frichette_n for including our threat research on #LLMjacking in @HackingthCloud's Year in Review. hackingthe.cloud/blog/2024_wrap…
As 2024 comes to a close it's time to look back on the year. For the first time ever "SSRF to the metadata service" was NOT the top article on Hacking the Cloud! What was? You'll have to read the post to find out :) Happy holidays everyone! hackingthe.cloud/blog/2024_wrap…
Nietzsche Virus Lab @NietzscheLab
154 Followers 474 Following macOS / linux malware research and red teaming stuff
Mike @theomegabit
3K Followers 1K Following AWS SA Pro | Security @trek10inc | CISSP/CCSP. Elsewhere - Bluesky: @theomegabit.xyz Mastodon: [email protected] Threads: @theomegabit
Double Tape @tape_double
7 Followers 453 Following
Gilles Katz @GillesGilKatz
16 Followers 60 Following Co-founder and CEO of PanIAM 🧑💻 https://t.co/4lUFQ4DmKY 🔗 https://t.co/VrgoU59f2p
Nir Zilberman @nirzilberman
87 Followers 8K Following
YahamBlaa @YahamBlaa
1 Followers 63 Following
Volkov Ivan @volkovin
61 Followers 5K Following
myfakemail nonamehere @MNonameher28500
0 Followers 46 Following
Sathishds @sathishdatwit
175 Followers 2K Following Incident response analyst, Interested in sharing Cyber threat hunting,Threat Intelligence, Malware analysis, Forensics artifacts, Red team blogs
jmonn @jmonn6
24 Followers 442 Following
MarleyTorres @MarleyTorr
0 Followers 35 Following
Govind Jha @cyberx00t
650 Followers 466 Following Full Time Bug Hunter , Jobless Hacker 🫡and Dad Soon :D . Logic Bug and BAC Lover 🤯 👌
吾日三瓶茅台 @hyper2junior
22 Followers 1K Following
f88e503131ebeb21175e9... @blimp3115
20 Followers 419 Following ¯\_(ツ)_/¯ Life is a freaking adventure.
mtcz91 @zhang91MTC
20 Followers 596 Following
Shukisha Zakayo @shukishazakayo
265 Followers 327 Following We will liberate this Country. #prosperous Kenya🇰🇪
Heber Blain @HeberBlain
10 Followers 344 Following
shiyan @shiyan2025
6 Followers 564 Following
Simo @Gr23c
31 Followers 920 Following
Denys Budnik @BudnikDenys
0 Followers 7 Following Future cloud security engineer 🧑💻. C++, AWS, PHP, cloud penetration testing.
jesus AG @JesusAg47464
3 Followers 219 Following
CentsToMe @CentsToMe
4K Followers 224 Following Father, husband, and investor. #Bitcoin #Solana #Stocks
Random Robbie @Random_Robbie
15K Followers 6K Following Hacker & Scanner of the internet All opinions here are yours. not mine I'm not responsible you are.
d0m @odomconstantino
3 Followers 54 Following
HN @HN_sS7TAXgU
0 Followers 8 Following
tonghuaroot @tonghuaroot
449 Followers 3K Following Staff Security Engineer. Cyber Security enthusiast, not Hacker. Focus on Application Security, Penetration testing. #OSCP #OSEP #RedTeam #AppSec #WebSec
yhino @_yhino
1 Followers 18 Following
ratnachakka @ratnachakka
51 Followers 456 Following Cyber Security professional. CISSP, CISM, CRISC, GCIA, CICP, GCIH, CEH, PCSA, PMP
Rob W @rob_pwners
196 Followers 668 Following Head of PenTesting @ ***, sushi enthusiast, and addicted to Valo.
tomato @tomato1931030
20 Followers 561 Following
Nitesh Surana @_niteshsurana
689 Followers 1K Following Cloud Research w/ Trend Micro | Opinions/retweets are personal reflections | Metalhead | If you can, be kind.
8-Ball @hippidikki
29 Followers 554 Following
Alex Delamotte @spiderspiders_
1K Followers 1K Following Threat Researcher @ SentinelLabs. Resident of Las Vegas. Unabashed Futurist. Probably a Shiny Pokémon in human-like form. Opinions are mine.
Zack @Zack21896373066
17 Followers 781 Following
Kiza Online @kizaonline
0 Followers 211 Following
Nick Frichette @Frichette_n
6K Followers 2K Following Staff Security Researcher @datadoghq | DEF CON/Black Hat main stage speaker | he/him | OSCP OSWE | Tweets are my own | Created https://t.co/QGWMJjv9pcTrends for United States
You might like
