How is Cloud Web Application Penetration Test Different from Conventional testing
As above topic?
For normal web application testing we are only given a URL and normal web user account. What other things can we exploit from a cloud based url? For example? Misconfigured S3 Bucket I only have come across the following so far: https://github.com/VirtueSecurity/aws-extender When I run this do I need to have other parameter in place?
2ndly, is it necessary to do a ScoutSuite on a top of a typical testing: https://github.com/nccgroup/ScoutSuite
Lastly, give a URL how to get the s3:// details?
For a standard penetration test where the tester is given a user login and the public URL of the web app, it does not matter where/how that app is hosted. The actions required to mitigate/remediate any findings might be different for an app running on AWS, but the test process itself should be the same.
For assessing the security of your AWS account more generally, there are a number of tools available:
- AWS Trusted Advisor provides a number of security checks including for public Snapshots and S3 Objects, potential IAM misconfiguration, and unrestricted security group rules.
- The Security Pillar of the AWS Well-Architected Framework, which provides guidance and recommendations to design and operate secure AWS workloads. You can also self-assess your current workloads by conducting a Well-Architected Framework Review from the AWS console.
- Other Security, Identity and Compliance services that can help you address your data protection, logging, monitoring, and incident response needs on AWS.
- Third party tools, such as the ones you identified in your post.
For further assistance you might also consider engaging with a AWS Security Competency Partner - these partners are vetted by AWS and have a proven track-record of helping customers improve their cloud security posture.
As JamesB mentioned, from a pure "Web-application" penetration testing point of view, the cloud itself is irrelevant.
One of the questions a lot struggle with is the following: what do we call validating any misconfigurations in the Cloud as Penetration testing, or rather, Security auditing of/for/in the cloud? One could be part of the other, or not at all.
In any case, to suggest specific tools, could you provide more info:
- Do you have access to the AWS accounts hosting the Web Application (such as ReadOnlyAccess)?
- Is the Web application hosted purely on S3, or EC2, ECS, EKS, etc?
- Or are you simply given a URL and a web-based user account and you are asked to perform a security pentest or audit purely from an attacker perspective on the internet?
cannot connect from web application to oracle rds from ISPAccepted Answerasked 3 years ago
Separate web and app serversAccepted Answerasked 2 years ago
Implement Security on the Web Application Without Touching the Web Applicationasked 6 months ago
AWSALB and AWSALBCORS are 3rd party cookies in webAccepted Answerasked 5 months ago
Which application types can use SQL Server Web Edition on RDS?asked 2 months ago
AWS WAF Web ACL (with Marketplace Rule Groups) via CloudFormationasked 3 years ago
How is Cloud Web Application Penetration Test Different from Conventional testingasked 13 days ago
AWS AppSync Penetration Testasked 3 years ago
Web application failed request monitoringasked 3 years ago
Penetration Test against App Runnerasked 9 days ago