Exploiting cloud services
The methods, techniques, and tools explained in this chapter can be used for services or applications hosted in the cloud, specifically Infrastructure-as-a-Service (IaaS) and Platform-as-a-Service (PaaS). These types of cloud architecture usually expose applications or services in close similarity to the on-premises environment and therefore are prone to the same types of attacks.
SaaS services within the cloud usually require different tools and techniques. One example is checking for weaker protocols implemented in such a setup and looking for a way to bypass the controls implemented – for example, bypassing MFA when legacy protocols are enabled.
Common vulnerabilities or misconfigurations in cloud services can be exploited. The following are a few examples:
- Incomplete or lack of MFA: Account passwords are vulnerable to theft or cracking when using some of the tools and techniques mentioned earlier in this chapter. The lack of or incomplete...
