Name: Performing Cloud Penetration Testing With Pacu
Author: mukul975

When to Use

When conducting authorized penetration testing of AWS environments
When validating the effectiveness of IAM policies, SCPs, and permission boundaries
When assessing the blast radius of a compromised set of AWS credentials
When testing detection capabilities of GuardDuty, Security Hub, and custom alerting
When building red team exercises against AWS cloud infrastructure

Do not use for unauthorized testing of any AWS account, for testing AWS infrastructure itself (covered by shared responsibility), for DDoS or volumetric attacks without AWS approval, or for production account testing without explicit authorization and breakglass procedures.

Prerequisites

Written authorization from the AWS account owner with defined scope and rules of engagement
Pacu v1.5+ installed (pip install pacu)
Test AWS credentials with limited starting permissions (simulates compromised credential scenario)
CloudTrail logging enabled to capture all Pacu activity for post-engagement review
GuardDuty enabled to validate detection of Pacu activities

When to Use

When conducting authorized penetration testing of AWS environments
When validating the effectiveness of IAM policies, SCPs, and permission boundaries
When assessing the blast radius of a compromised set of AWS credentials
When testing detection capabilities of GuardDuty, Security Hub, and custom alerting
When building red team exercises against AWS cloud infrastructure

Prerequisites

Written authorization from the AWS account owner with defined scope and rules of engagement
Pacu v1.5+ installed (pip install pacu)
Test AWS credentials with limited starting permissions (simulates compromised credential scenario)
CloudTrail logging enabled to capture all Pacu activity for post-engagement review
GuardDuty enabled to validate detection of Pacu activities

Term	Definition
Pacu	Open-source AWS exploitation framework maintained by Rhino Security Labs, providing modular attack capabilities for authorized penetration testing
Privilege Escalation Scan	Automated analysis of IAM policies to identify known methods for elevating permissions from limited access to administrative control
iam:PassRole	Critical IAM action allowing a principal to assign roles to AWS services, enabling indirect privilege escalation through Lambda, EC2, or Glue
Cross-Account Role Assumption	Using sts:AssumeRole to obtain temporary credentials in another AWS account through trust policy configurations
Rules of Engagement	Documented agreement defining the scope, methods, timing, and boundaries of a penetration testing engagement
Post-Exploitation	Activities performed after initial access to demonstrate impact, including data access, lateral movement, and persistence establishment

Performing Cloud Penetration Testing With Pacu

When to Use

Prerequisites

Performing Cloud Penetration Testing With Pacu

When to Use

Prerequisites

Workflow

Step 1: Initialize Pacu Session and Configure Credentials

Step 2: Enumerate IAM Configuration

Step 3: Scan for Privilege Escalation Paths

Step 4: Enumerate and Test Data Access

Step 5: Test Lateral Movement and Persistence

Step 6: Validate Detection and Generate Report

Key Concepts

Tools & Systems

Common Scenarios

Scenario: Red Team Assessment Starting from Compromised Developer Credentials

Output Format

1password

Springboot Security

Security Review

Laravel Security

Security Review

Django Security