A tour of the AWS privilege escalation techniques modelled by PMapper and awspx, where each of them falls short, and how I rebuilt Snotra's shadow administrator detection to cover everything they do - and a good deal they do not.
How Entra ID App Registrations / Enterprise Applications are commonly misconfigured and can be used by attackers to elevate privileges, access sensitive information and move laterally across Azure tenancies.
Exploiting overly permissive VPC endpoints to exfiltrate data from private AWS subnets
Simple method to define and build security testing containers in Podman
Attacking AWS Accounts from a black box perspective
Using Snotra to Check For Sensitive Tags
Making Sense of Logging in Azure with Azure Monitor, Diagnostic Settings and Activity Log Alerts
AWS and overly permissive GitHub OIDC cross-account role trust policies
Blog post about Cloud Configuration Reviews
How to own an internal domain and pivot into the cloud