Cloud Security
Difficulty: hard
Log Format: syslog
Cloud Heist
A web app with a URL-fetching feature just became the attacker's proxy. They used it to hit the EC2 metadata service, grabbed IAM credentials, and used them from their own IP to download three S3 files before you noticed. Trace the full cloud attack chain.
AWSSSRFIMDSIAMCloud
Investigation Scenario
A web app with a URL-fetching feature just became the attacker's proxy. They used it to hit the EC2 metadata service, grabbed IAM credentials, and used them from their own IP to download three S3 files before you noticed. Trace the full cloud attack chain.