Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources

github.com

Post reply on HN
Print view View original

41–50 of 101 posts

Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources

#41

Post by jasperran »

stjohnswarts wrote: post #33
kmcquade wrote: post #4

Earlier quoted context omitted.

Author here :) Endgame exploits/abuses features. If it was a bug, I'd work with AWS to solve the problem, but with abusing features - that would result in years of unsatisfied feature requests. This should push the issue along. >...and it's not even a hacking tool! It can be used to backdoor resources to rogue accounts, so I'd say it's a hacking tool and can/should be used on penetration tests. I'd certainly use it o…

So did you just put this out there or did you give AWS Security peeps a week or two notice?

This isn't exploiting a vulnerability. This requires authentication and uses AWS features. Why would they need to alert AWS?

Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources

#42

Post by jasperran »

Operyl wrote: post #16
kmcquade wrote: post #4

Earlier quoted context omitted.

Author here :) Endgame exploits/abuses features. If it was a bug, I'd work with AWS to solve the problem, but with abusing features - that would result in years of unsatisfied feature requests. This should push the issue along. >...and it's not even a hacking tool! It can be used to backdoor resources to rogue accounts, so I'd say it's a hacking tool and can/should be used on penetration tests. I'd certainly use it o…

I'm impressed you were able to get your employer (Salesforce) to actually let you publish this under their organization. Kudos to that.

Not sure what the shock is with seeing security tools like this released, the vast majority of security tools are open source, how is this different to what we have been seeing the past 30 year?

Not to mention companies such as Google, Netflix and Mozilla all release security tools just like this.

Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources

#43

Post by ramimac »

tbrock wrote: post #27

Can someone explain why you'd ever want to run this in the non-dryrun mode? I understand that if you have these problems you've already effectively granted those permissions anyway but actually executing them before someone finds them lowers the bar quite a bit for other baddies to attack.

Exposing resources to a specific "evil principal" via Endgame would be reasonable in some attack simulations/red team engagements

Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources

#44

Post by jasperran »

simonebrunozzi wrote: post #40

Make sure you check AWS' pentesting policy [0]. [0]: https://aws.amazon.com/security/penetration-testing/

Given that they wrote a tool dedicated to pentesting AWS, I'm sure the author is very familiar with that.

Also the pentesting policy explicitly states that customers can pentest without approval.

Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources

#45

Post by hnjst »

tbrock wrote: post #27

Can someone explain why you'd ever want to run this in the non-dryrun mode? I understand that if you have these problems you've already effectively granted those permissions anyway but actually executing them before someone finds them lowers the bar quite a bit for other baddies to attack.

To test autoremediation and alerting. At least in the environment I'm evolving these days it makes sense.

Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources

#48

Post by Serow225 »

kmcquade wrote: post #8
gchamonlive wrote: post #6

Earlier quoted context omitted.

dry run should be the default, and for you to actually do damage, you should explicitly run with a flag like `--commit` or `--deploy-evil-payload "yes I am certain of this"`

Dry run as default is a good idea. I'll open a GitHub issue for that. FWIW, if you run `endgame smash` with `--service all`, then it spits out a huge "WARNING" in ASCII art with an explanation and a confirmation prompt. But I agree, we should have dry-run on by default.

Yes please, thanks!!

Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources

#50

Post by artful-hacker »

tbrock wrote: post #27

Can someone explain why you'd ever want to run this in the non-dryrun mode? I understand that if you have these problems you've already effectively granted those permissions anyway but actually executing them before someone finds them lowers the bar quite a bit for other baddies to attack.

Red team exercises come to mind.
Post reply on HN