Virtually every organisation runs critical infrastructure on AWS, Azure, or GCP in 2026. And virtually every one of them has IAM misconfigurations, overpermissive S3 buckets, or exposed metadata endpoints that an attacker can pivot from initial access to full cloud account takeover. Cloud security hacking is the highest-demand offensive skill of 2026 — and the highest-paying specialisation in bug bounty. This guide covers the attack surface, the tools, and the methodology ethical hackers use to find and prove cloud vulnerabilities in authorised engagements.
- The Cloud Attack Surface — What’s Different
- Top Cloud Misconfigurations — What Attackers Target First
- IAM Attacks — The #1 Cloud Attack Vector
- S3 Bucket Attacks — Finding Exposed Data
- SSRF to Cloud Metadata — The Critical Path
- Cloud Privilege Escalation — From User to Admin
- Cloud Pentesting Tools — Pacu, ScoutSuite, CloudFox
- Cloud Red Team Methodology — Authorised Engagement Approach
The Cloud Attack Surface — What’s Different
Traditional network penetration testing focuses on open ports, running services, and software vulnerabilities. Cloud penetration testing shifts the focus fundamentally: the primary attack surface in cloud environments is not software vulnerabilities — it is configuration mistakes. IAM policies that grant too many permissions. Storage buckets with public access. Logging disabled so attacker actions go undetected. Security groups open to the world.
The cloud provider secures the physical infrastructure. The customer secures everything they configure on top of it — and that includes IAM, storage permissions, network access controls, logging, encryption, and dozens of other settings. Misconfiguring any of these creates an exploitable attack surface that exists nowhere in the traditional network model.
Software vulnerabilities (CVEs)
Default credentials
Network segmentation gaps
Kernel and OS exploits
Physical access controls
Public storage buckets
Missing MFA on cloud accounts
Overpermissive security groups
Logging and monitoring gaps
Exposed metadata endpoints
Serverless/container misconfigs
Top Cloud Misconfigurations — What Attackers Target First
Cloud security assessments consistently find the same categories of misconfigurations across organisations of all sizes. These are not exotic vulnerabilities — they are common configuration defaults left unchanged, or best practices not applied. Each one represents a high-probability finding in any cloud engagement.
"Action": "*" or "Resource": "*" grant far more access than needed. Finding: any identity that assumes this role has full access to targeted service. Real-world impact: lambda functions, EC2 instances, and developer accounts routinely found with admin-equivalent policies.IAM Attacks — The #1 Cloud Attack Vector
Identity and Access Management (IAM) is the central nervous system of every cloud environment — it controls who can do what to which resources. Misconfigurations in IAM are the primary attack vector in 2026 cloud breaches, accounting for the majority of significant cloud security incidents. Understanding IAM is to cloud security what understanding TCP/IP is to network security.
# Determine current identity aws sts get-caller-identity # List all IAM users aws iam list-users # List attached policies for a user aws iam list-attached-user-policies --user-name [username] # Get all permissions in the account (requires iam:GetAccountAuthorizationDetails) aws iam get-account-authorization-details # List IAM roles (potential privilege escalation via role assumption) aws iam list-roles # Check if current identity can assume a role aws sts assume-role --role-arn arn:aws:iam::[ACCOUNT]:role/[ROLENAME] --role-session-name test # Check access keys (looking for unused/old keys) aws iam list-access-keys --user-name [username] aws iam get-access-key-last-used --access-key-id [KEY_ID] # Automated IAM enumeration and privilege escalation detection pacu # launch Pacu framework Pacu> run iam__enum_permissions # enumerate all permissions Pacu> run iam__privesc_scan # scan for privilege escalation paths
S3 Bucket Attacks — Finding Exposed Data
S3 bucket misconfigurations consistently produce some of the most impactful findings in cloud security assessments — and some of the highest bug bounty payouts for researchers who find them on in-scope programmes. The challenge is that bucket exposure is often invisible to the organisation: files are accessible to anyone with the URL, but without active scanning, the organisation may have no idea their data is publicly readable.
# List all S3 buckets in the account (requires s3:ListAllMyBuckets) aws s3 ls # Check public access block settings for a bucket aws s3api get-public-access-block --bucket [BUCKET-NAME] # All 4 settings should be "true" — if any are "false", public access possible # Check bucket ACL aws s3api get-bucket-acl --bucket [BUCKET-NAME] # Look for "AllUsers" or "AuthenticatedUsers" grantees = public access # Check bucket policy aws s3api get-bucket-policy --bucket [BUCKET-NAME] # Look for "Principal": "*" = any identity can perform allowed actions # List objects in bucket (if public) aws s3 ls s3://[BUCKET-NAME] --no-sign-request # --no-sign-request = test unauthenticated access # ScoutSuite for complete S3 audit across the account scout aws --no-browser -r [REGION] # Generates HTML report with all S3 misconfigurations flagged
aws s3 ls s3://target-backup-bucket --no-sign-request and receive a list of objects including database_backup_2026.sql. What does this confirm?SSRF to Cloud Metadata — The Critical Path
The combination of an SSRF vulnerability in a web application and a cloud-hosted EC2 instance creates a Critical attack chain: SSRF → AWS metadata endpoint → IAM credentials → full AWS service access. This chain was the root cause of the Capital One breach and remains one of the most impactful findings in cloud security assessments in 2026. We covered SSRF hunting in detail in Bug Bounty Day 10 — this section covers the cloud escalation phase specifically.
# AWS IMDSv1 (via SSRF on EC2-hosted application) http://169.254.169.254/latest/meta-data/ # root metadata http://169.254.169.254/latest/meta-data/iam/security-credentials/ # IAM role name http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE] # CRITICAL: creds # GCP — requires Metadata-Flavor: Google header http://metadata.google.internal/computeMetadata/v1/ http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token # Azure — requires Metadata: true header http://169.254.169.254/metadata/instance?api-version=2021-02-01 http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/ # STOP AT ROLE NAME — do NOT exfiltrate/use actual credentials # Confirming metadata endpoint = accessible → Critical severity → report immediately
If SSRF returns AWS IAM credentials (AccessKeyId, SecretAccessKey, Token): stop immediately. Screenshot the response showing the credential structure only — blur/redact actual key values. Do NOT use the credentials to access any AWS service. Do NOT attempt to enumerate their permissions. Report immediately at Critical severity. Using exfiltrated cloud credentials — even “to demonstrate impact” — violates programme safe harbour and potentially computer fraud law.
Cloud Privilege Escalation — From User to Admin
Cloud privilege escalation differs fundamentally from traditional OS privilege escalation. Instead of kernel exploits and SUID binaries, cloud privesc exploits IAM policy misconfigurations — finding a sequence of allowed IAM actions that cumulatively grant admin access from a low-privilege starting point. Rhinosecurity Labs documented over 20 distinct AWS privilege escalation paths, all of which remain valid in 2026.
Pacu > run iam__privesc_scan automatically checks all known privilege escalation paths for your current identity. Reports which paths are exploitable given your current permissions.Cloud Pentesting Tools — Pacu, ScoutSuite & CloudFox
pacu
Pacu> set_keys # configure AWS creds
Pacu> run iam__enum_permissions # enumerate current identity
Pacu> run iam__privesc_scan # find escalation paths
scout aws –no-browser # AWS audit
scout azure –no-browser # Azure audit
scout gcp –no-browser # GCP audit
cloudfox aws –profile [profile] permissions
cloudfox aws –profile [profile] instances
Cloud Red Team Methodology — Authorised Engagement Approach
iam:AttachUserPolicy. What should you do next?
# ── AWS IDENTITY & IAM ────────────────────────────────────────── aws sts get-caller-identity # who am I? aws iam list-users # list IAM users aws iam list-roles # list IAM roles aws iam get-account-authorization-details # full IAM config # ── S3 BUCKET TESTING ─────────────────────────────────────────── aws s3 ls # list all buckets aws s3 ls s3://[bucket] --no-sign-request # anon access test aws s3api get-public-access-block --bucket [bucket] aws s3api get-bucket-policy --bucket [bucket] # ── CLOUD METADATA (SSRF TARGET, IN-SCOPE ONLY) ───────────────── http://169.254.169.254/latest/meta-data/iam/security-credentials/ http://metadata.google.internal/computeMetadata/v1/ # ── AUTOMATED TOOLS ───────────────────────────────────────────── scout aws --no-browser # full AWS security audit pacu # AWS exploitation framework Pacu> run iam__privesc_scan # escalation paths cloudfox aws --profile [p] all-checks # attack path mapping
The ethical hacker who tests cloud finds the most critical vulnerabilities.
Start with our free ethical hacking course to build the web and network fundamentals, then extend into cloud security testing with Pacu, ScoutSuite, and CloudFox.
Frequently Asked Questions – Cloud Security Hacking
SecurityElites — Free Ethical Hacking Course — build the foundations before cloud specialisation
SecurityElites — Ethical Hacking Roadmap 2026 — where cloud security fits in the modern pentester career
Rhino Security Labs — AWS Privilege Escalation Methods — the definitive reference for IAM escalation paths →
ScoutSuite GitHub — multi-cloud security auditing tool for authorised engagements →
The first cloud assessment I ran took me two hours to find a publicly accessible S3 bucket containing the company’s entire user database — complete with hashed passwords and PII for 2.3 million customers. The misconfiguration had been in place for 14 months. No one had noticed. ScoutSuite flagged it in 12 minutes. Cloud security is where a single configuration check produces findings that traditional pentesting takes days of manual work to uncover. It is the most ROI-positive skill investment in offensive security in 2026.
