1 1 00:00:00,090 --> 00:00:00,930 In this lesson, 2 2 00:00:00,930 --> 00:00:02,880 we're going to spend some time looking at a couple 3 3 00:00:02,880 --> 00:00:06,300 of reports when you're conducting cloud auditing. 4 4 00:00:06,300 --> 00:00:08,040 Now for the exam, you don't need to be able 5 5 00:00:08,040 --> 00:00:10,290 to go through all these reports and understand them 6 6 00:00:10,290 --> 00:00:12,120 step by step by step, 7 7 00:00:12,120 --> 00:00:13,950 but I just want to give you a good overview 8 8 00:00:13,950 --> 00:00:16,830 so you can then explore more on your own. 9 9 00:00:16,830 --> 00:00:17,663 We're going to take a look 10 10 00:00:17,663 --> 00:00:20,670 at a couple of auditing reports based upon 11 11 00:00:20,670 --> 00:00:23,220 a misconfigured cloud environment. 12 12 00:00:23,220 --> 00:00:26,910 To do this, we're going to use a tool known as sadcloud. 13 13 00:00:26,910 --> 00:00:30,990 Now, sadcloud is an intentionally vulnerable distribution 14 14 00:00:30,990 --> 00:00:32,700 of a cloud infrastructure 15 15 00:00:32,700 --> 00:00:36,690 and it's for use inside of the Amazon Web Services cloud. 16 16 00:00:36,690 --> 00:00:39,660 If you'd like to be able to spin this up yourself, you can. 17 17 00:00:39,660 --> 00:00:41,520 All the instructions are on their GitHub 18 18 00:00:41,520 --> 00:00:46,080 at github/nccgroup/sadcloud. 19 19 00:00:46,080 --> 00:00:46,913 Now, the makers 20 20 00:00:46,913 --> 00:00:50,100 of sadcloud are the same people who make ScoutSuite 21 21 00:00:50,100 --> 00:00:51,480 and so they provided this as a way 22 22 00:00:51,480 --> 00:00:53,520 for us to learn how to use that tool, 23 23 00:00:53,520 --> 00:00:54,990 look at the different auditing reports 24 24 00:00:54,990 --> 00:00:56,160 that are generated from it, 25 25 00:00:56,160 --> 00:00:58,350 and then use other tools against it as well. 26 26 00:00:58,350 --> 00:01:02,040 Think about sadcloud like you would Metasploitable 2. 27 27 00:01:02,040 --> 00:01:04,560 Metasploitable 2 is a vulnerable virtual machine 28 28 00:01:04,560 --> 00:01:06,960 that you can then attack using Kali Linux. 29 29 00:01:06,960 --> 00:01:10,500 Well, sadcloud is a vulnerable cloud infrastructure 30 30 00:01:10,500 --> 00:01:12,649 with servers and other misconfigurations 31 31 00:01:12,649 --> 00:01:13,920 that you can then look at 32 32 00:01:13,920 --> 00:01:15,120 using the different tools 33 33 00:01:15,120 --> 00:01:17,010 in the cloud area to be able to get better 34 34 00:01:17,010 --> 00:01:20,010 at using those tools and using them for the real world. 35 35 00:01:20,010 --> 00:01:22,863 If you go over to github.com/nccgroup/sadcloud, 36 36 00:01:25,530 --> 00:01:27,900 you could scroll down through their readme. 37 37 00:01:27,900 --> 00:01:29,640 In the readme, they explain a little bit 38 38 00:01:29,640 --> 00:01:32,280 about what this particular system is. 39 39 00:01:32,280 --> 00:01:35,520 As you can see here, there are 22 AWS services 40 40 00:01:35,520 --> 00:01:38,100 with 84 different misconfigurations 41 41 00:01:38,100 --> 00:01:40,860 that they put inside of sadcloud. 42 42 00:01:40,860 --> 00:01:43,410 They do this so they can then look at it using tools 43 43 00:01:43,410 --> 00:01:46,800 like ScoutSuite, Prowler, and many others. 44 44 00:01:46,800 --> 00:01:48,780 Now, sadcloud was, as I said, 45 45 00:01:48,780 --> 00:01:51,810 a way for security researchers to be able to learn more 46 46 00:01:51,810 --> 00:01:55,200 about cloud vulnerabilities inside of AWS 47 47 00:01:55,200 --> 00:01:58,950 and it's a great tool for us as future penetration testers. 48 48 00:01:58,950 --> 00:02:01,080 Now, if you're going to do this, you need to know 49 49 00:02:01,080 --> 00:02:04,680 that you will incur some cost by running sadcloud. 50 50 00:02:04,680 --> 00:02:08,760 It costs about $10 per day for the cloud compute time, 51 51 00:02:08,760 --> 00:02:10,890 so if you are going to use sadcloud, 52 52 00:02:10,890 --> 00:02:12,930 you don't want to leave this running 24 hours a day, 53 53 00:02:12,930 --> 00:02:14,070 seven days a week 54 54 00:02:14,070 --> 00:02:16,050 because it'll start eating up a lot of money 55 55 00:02:16,050 --> 00:02:18,390 inside of your budget for cloud computing. 56 56 00:02:18,390 --> 00:02:21,270 Instead though, you can go ahead and turn it on. 57 57 00:02:21,270 --> 00:02:24,000 You can run your scans or run your hacks against it 58 58 00:02:24,000 --> 00:02:26,370 and then you can shut it back down again. 59 59 00:02:26,370 --> 00:02:28,380 There are instructions of how to do all of that 60 60 00:02:28,380 --> 00:02:31,020 here in the GitHub for sadcloud. 61 61 00:02:31,020 --> 00:02:33,270 Now, in this particular lesson, we're going to focus 62 62 00:02:33,270 --> 00:02:36,510 on the actual outputs of those scans that you would get 63 63 00:02:36,510 --> 00:02:39,720 by using something like ScoutSuite or Prowler as opposed 64 64 00:02:39,720 --> 00:02:41,790 to running those scans ourself. 65 65 00:02:41,790 --> 00:02:43,650 Now, if you want to run those scans yourself, 66 66 00:02:43,650 --> 00:02:45,720 it's not really difficult to do. 67 67 00:02:45,720 --> 00:02:48,810 If you go over to the GitHub for nccgroup, 68 68 00:02:48,810 --> 00:02:53,070 you'll also find one called nccgroup/ScoutSuite 69 69 00:02:53,070 --> 00:02:55,650 and this is the actual tool for ScoutSuite. 70 70 00:02:55,650 --> 00:02:57,390 If you scroll down in the readme, 71 71 00:02:57,390 --> 00:02:59,730 there are instructions of how to run this tool 72 72 00:02:59,730 --> 00:03:01,530 and it really is simple to run it. 73 73 00:03:01,530 --> 00:03:04,680 You're simply going to type in Scout Space AWS 74 74 00:03:04,680 --> 00:03:06,090 if you're doing it against sadcloud 75 75 00:03:06,090 --> 00:03:10,157 and AWS --profile and then basc -F 76 76 00:03:11,970 --> 00:03:15,030 and this will go through and run a scan against 77 77 00:03:15,030 --> 00:03:18,360 that sadcloud infrastructure that you have then deployed. 78 78 00:03:18,360 --> 00:03:20,250 But what we're going to do is instead of running it 79 79 00:03:20,250 --> 00:03:22,800 we are going to look at the report that comes from it 80 80 00:03:22,800 --> 00:03:26,670 and if you go over to the sadcloud GitHub, there are links 81 81 00:03:26,670 --> 00:03:29,280 to this audit report as well that you can go through 82 82 00:03:29,280 --> 00:03:32,190 on your own and explore it a little bit more in depth. 83 83 00:03:32,190 --> 00:03:33,510 When you run ScoutSuite, 84 84 00:03:33,510 --> 00:03:36,300 you are going to get a report like this generated based 85 85 00:03:36,300 --> 00:03:38,580 on this cloud that you have just scanned. 86 86 00:03:38,580 --> 00:03:39,440 You could see here all 87 87 00:03:39,440 --> 00:03:42,000 of the services listed on the main dashboard 88 88 00:03:42,000 --> 00:03:45,810 the resources, the rules, the findings, and the checks. 89 89 00:03:45,810 --> 00:03:47,700 Each of these is for a different service 90 90 00:03:47,700 --> 00:03:50,160 inside of Amazon Web Services. 91 91 00:03:50,160 --> 00:03:54,060 You'll notice if we scroll down, the EC2 is one 92 92 00:03:54,060 --> 00:03:57,570 of the largest that we have with the most vulnerabilities. 93 93 00:03:57,570 --> 00:03:58,890 Now, why is that? 94 94 00:03:58,890 --> 00:04:02,250 Well, because EC2 is elastic computing 95 95 00:04:02,250 --> 00:04:03,900 and that means virtual servers. 96 96 00:04:03,900 --> 00:04:06,030 These are virtual machines and there's lots 97 97 00:04:06,030 --> 00:04:08,400 of different vulnerabilities that are associated with that. 98 98 00:04:08,400 --> 00:04:09,660 The other one that is really high 99 99 00:04:09,660 --> 00:04:12,360 that you can see with the red exclamation is IAM 100 100 00:04:12,360 --> 00:04:15,300 which are identity and access management. 101 101 00:04:15,300 --> 00:04:17,790 So as we go through, you can click on any of these. 102 102 00:04:17,790 --> 00:04:20,790 For instance, let's go ahead and click on EC2. 103 103 00:04:20,790 --> 00:04:22,080 By clicking on EC2, 104 104 00:04:22,080 --> 00:04:24,930 we can now see all the vulnerabilities we have. 105 105 00:04:24,930 --> 00:04:26,910 Now, as you can see going across the top, 106 106 00:04:26,910 --> 00:04:28,680 we do have four filters. 107 107 00:04:28,680 --> 00:04:32,070 We have show all, good, warning and danger. 108 108 00:04:32,070 --> 00:04:34,590 If I click on good, I'm only going to see the things 109 109 00:04:34,590 --> 00:04:36,780 that pass the vulnerability scan. 110 110 00:04:36,780 --> 00:04:40,080 In this case, the public EBS snapshot was good. 111 111 00:04:40,080 --> 00:04:42,540 If I want to see the details, I can click on the plus 112 112 00:04:42,540 --> 00:04:43,890 and here I'll get a description 113 113 00:04:43,890 --> 00:04:45,990 that the snapshots should never be public 114 114 00:04:45,990 --> 00:04:48,420 because that could risk exposing sensitive data 115 115 00:04:48,420 --> 00:04:50,190 and in this case, there was one snapshot 116 116 00:04:50,190 --> 00:04:54,000 and it was not public, so this was considered a good check. 117 117 00:04:54,000 --> 00:04:56,850 Now these snapshots are considered backups 118 118 00:04:56,850 --> 00:04:58,830 and they contain all the state information 119 119 00:04:58,830 --> 00:05:01,050 from a particular virtual machine. 120 120 00:05:01,050 --> 00:05:03,210 Now, if I want to see all the things that were warnings, 121 121 00:05:03,210 --> 00:05:04,290 I could click on warning 122 122 00:05:04,290 --> 00:05:06,630 and you could see there are several warning areas here 123 123 00:05:06,630 --> 00:05:08,460 including all ports being open, 124 124 00:05:08,460 --> 00:05:10,290 the default security groups in use, 125 125 00:05:10,290 --> 00:05:13,530 non empty rule sets for default security groups and others. 126 126 00:05:13,530 --> 00:05:16,140 Again, if you want to get more details about what it found 127 127 00:05:16,140 --> 00:05:17,370 just go ahead and click here, 128 128 00:05:17,370 --> 00:05:19,320 and in this case it checks 73 rules 129 129 00:05:19,320 --> 00:05:21,660 and there is 26 open ports 130 130 00:05:21,660 --> 00:05:24,060 so we'd have to go in further to be able to figure that out 131 131 00:05:24,060 --> 00:05:27,060 as we look through some of the tabs of ScoutSuite. 132 132 00:05:27,060 --> 00:05:28,500 Next, if we go to danger 133 133 00:05:28,500 --> 00:05:31,140 we will see everything that is a big danger area 134 134 00:05:31,140 --> 00:05:32,820 that we really need to take care of. 135 135 00:05:32,820 --> 00:05:35,460 In this case, again, we have all ports being open 136 136 00:05:35,460 --> 00:05:37,800 and we had two rules that were flagged here 137 137 00:05:37,800 --> 00:05:39,480 out of 69 that were checked. 138 138 00:05:39,480 --> 00:05:41,970 If I look at DNS port, that's open to all. 139 139 00:05:41,970 --> 00:05:44,220 We could see again, one rule was flagged 140 140 00:05:44,220 --> 00:05:46,170 with EBS not being encrypted. 141 141 00:05:46,170 --> 00:05:48,750 There is one snapshot check and one was flagged 142 142 00:05:48,750 --> 00:05:51,300 so there was no encryption on that snapshot. 143 143 00:05:51,300 --> 00:05:54,630 Again, the EBS volume itself was not encrypted. 144 144 00:05:54,630 --> 00:05:56,370 That was again, we had three volumes checked 145 145 00:05:56,370 --> 00:05:57,990 and three of them were flagged 146 146 00:05:57,990 --> 00:05:59,280 so these are things that we'd want to go 147 147 00:05:59,280 --> 00:06:02,610 and fix as somebody who is a network defender. 148 148 00:06:02,610 --> 00:06:04,830 Next, we can go click back onto ScoutSuite 149 149 00:06:04,830 --> 00:06:06,720 to see our main dashboard again 150 150 00:06:06,720 --> 00:06:07,890 and we can pick another area. 151 151 00:06:07,890 --> 00:06:09,513 Let's go ahead and choose IAM. 152 152 00:06:10,698 --> 00:06:13,530 IAM is our identity and access management 153 153 00:06:13,530 --> 00:06:16,770 and this is all about rules, roles, and permissions, 154 154 00:06:16,770 --> 00:06:17,850 and so as we go through, 155 155 00:06:17,850 --> 00:06:20,070 we can see some things that are lacking. 156 156 00:06:20,070 --> 00:06:23,280 For instance, we have a cross account assumerole policy 157 157 00:06:23,280 --> 00:06:27,390 lacks external ID and multifactor authentication. 158 158 00:06:27,390 --> 00:06:28,223 This says that 159 159 00:06:28,223 --> 00:06:30,450 when you're authorizing cross account role assumption, 160 160 00:06:30,450 --> 00:06:33,120 you should require multifactor authentication. 161 161 00:06:33,120 --> 00:06:36,690 In this case, we checked it against 13 accounts or 13 roles 162 162 00:06:36,690 --> 00:06:37,767 and one of those was flagged 163 163 00:06:37,767 --> 00:06:39,480 and so we'd want to figure that one out 164 164 00:06:39,480 --> 00:06:42,060 and then go dive into that to get that fixed. 165 165 00:06:42,060 --> 00:06:44,490 Now, in addition to looking at each individual thing 166 166 00:06:44,490 --> 00:06:45,870 that comes up on the dashboard 167 167 00:06:45,870 --> 00:06:48,750 we can actually dive down a little bit deeper as well. 168 168 00:06:48,750 --> 00:06:51,990 To do that, just go up here to security, click on that 169 169 00:06:51,990 --> 00:06:54,750 and then go to IAM, and instead of going to dashboard 170 170 00:06:54,750 --> 00:06:56,970 we can actually look at the password policy, 171 171 00:06:56,970 --> 00:07:00,510 the permissions, or the IAM configuration itself. 172 172 00:07:00,510 --> 00:07:01,560 Let's go ahead and take a look 173 173 00:07:01,560 --> 00:07:04,143 at the roles underneath IAM config. 174 174 00:07:05,040 --> 00:07:05,880 Underneath the roles, 175 175 00:07:05,880 --> 00:07:07,800 you'll see lots of good information. 176 176 00:07:07,800 --> 00:07:10,620 Here we have AWS Config example role 177 177 00:07:10,620 --> 00:07:12,540 and in this case we see the ID, 178 178 00:07:12,540 --> 00:07:15,510 we see the Amazon resource number, the description, 179 179 00:07:15,510 --> 00:07:17,010 the creation date, the path, 180 180 00:07:17,010 --> 00:07:19,290 and the maximum session duration. 181 181 00:07:19,290 --> 00:07:20,880 Underneath role trust policy, 182 182 00:07:20,880 --> 00:07:22,890 we can click that to see details 183 183 00:07:22,890 --> 00:07:25,770 and in this case we see that this is an assumed role. 184 184 00:07:25,770 --> 00:07:30,540 The effect is allow, the service is config.amazonaws.com 185 185 00:07:30,540 --> 00:07:33,810 and it was created with version 2012 10 17. 186 186 00:07:33,810 --> 00:07:36,540 We can see the supplies to zero instances, 187 187 00:07:36,540 --> 00:07:39,690 zero inline policies, and zero managed policies. 188 188 00:07:39,690 --> 00:07:41,640 Then we have the next role, and we can keep going through 189 189 00:07:41,640 --> 00:07:43,840 all of these roles as we're looking at them. 190 190 00:07:44,730 --> 00:07:46,980 Additionally, we can go back up here 191 191 00:07:46,980 --> 00:07:48,900 and we can go to our IAM 192 192 00:07:48,900 --> 00:07:50,850 and we can go to our credential report. 193 193 00:07:51,780 --> 00:07:54,450 Under our credential report, we can learn information 194 194 00:07:54,450 --> 00:07:56,970 about the particular passwords and authentications 195 195 00:07:56,970 --> 00:07:58,530 that are currently in use. 196 196 00:07:58,530 --> 00:08:00,300 So based on this credential report, 197 197 00:08:00,300 --> 00:08:03,510 we can see the user rami never used their password. 198 198 00:08:03,510 --> 00:08:06,120 There is no date available and there is no MFA 199 199 00:08:06,120 --> 00:08:08,610 or multifactor authentication active. 200 200 00:08:08,610 --> 00:08:11,307 They do have access keys 1 and 2 that are active 201 201 00:08:11,307 --> 00:08:14,650 and we could see that those were last used back in 2019 202 202 00:08:14,650 --> 00:08:18,540 and 2020, which was over two and three years ago. 203 203 00:08:18,540 --> 00:08:21,140 If we go to the next user, we see sadcloudinlineUser 204 204 00:08:22,230 --> 00:08:25,260 and again, we have the password that was never used, 205 205 00:08:25,260 --> 00:08:26,520 MFA being false, 206 206 00:08:26,520 --> 00:08:29,430 and in this case we do not have any active keys. 207 207 00:08:29,430 --> 00:08:30,450 We scroll the next person. 208 208 00:08:30,450 --> 00:08:31,740 We have the root account. 209 209 00:08:31,740 --> 00:08:35,310 The root account has the password last used in 2020. 210 210 00:08:35,310 --> 00:08:38,700 MFA is true, so they are using multifactor authentication 211 211 00:08:38,700 --> 00:08:41,790 but they do not have access keys 1 and 2 active. 212 212 00:08:41,790 --> 00:08:43,020 To go to jdow, 213 213 00:08:43,020 --> 00:08:46,140 we can see this person also has MFA turned off. 214 214 00:08:46,140 --> 00:08:48,090 They have access key 1 is true. 215 215 00:08:48,090 --> 00:08:49,890 Access key 2 is false 216 216 00:08:49,890 --> 00:08:53,400 and we can see the password was last used in 2019. 217 217 00:08:53,400 --> 00:08:54,233 Alright. 218 218 00:08:54,233 --> 00:08:55,440 As we continue to go through, 219 219 00:08:55,440 --> 00:08:57,540 you can find more and more information 220 220 00:08:57,540 --> 00:08:59,280 as you go through the different services. 221 221 00:08:59,280 --> 00:09:01,170 In this case, I'm looking at S3 222 222 00:09:01,170 --> 00:09:03,510 which is our buckets that contain our objects 223 223 00:09:03,510 --> 00:09:06,330 which is another way of saying our folders and our files 224 224 00:09:06,330 --> 00:09:09,060 and here you can see there are two dangers listed. 225 225 00:09:09,060 --> 00:09:11,280 All actions authorized to all principles 226 226 00:09:11,280 --> 00:09:13,830 and get actions authorized to all principles. 227 227 00:09:13,830 --> 00:09:16,440 If I look at that, I can see that the buckets were checked, 228 228 00:09:16,440 --> 00:09:18,450 there was seven, and one of them was flagged. 229 229 00:09:18,450 --> 00:09:21,120 Only one of them has an issue, and again, we are looking 230 230 00:09:21,120 --> 00:09:23,790 at the summary level when we're on the dashboard. 231 231 00:09:23,790 --> 00:09:26,100 To dig in deeper and find out which ones it would be 232 232 00:09:26,100 --> 00:09:28,440 we would click down here onto buckets 233 233 00:09:28,440 --> 00:09:30,120 and this would give us more information 234 234 00:09:30,120 --> 00:09:32,580 about those particular buckets, and that's where 235 235 00:09:32,580 --> 00:09:35,550 we'd be able to find the information and the ACLs for each 236 236 00:09:35,550 --> 00:09:37,770 of these different buckets, whether they have list, 237 237 00:09:37,770 --> 00:09:40,620 upload delete, view permissions, or edit permissions 238 238 00:09:40,620 --> 00:09:43,290 as well as the groups with access, the roles with access 239 239 00:09:43,290 --> 00:09:46,380 and the users with access based on these particular buckets 240 240 00:09:46,380 --> 00:09:48,180 as you go through all of them. 241 241 00:09:48,180 --> 00:09:50,310 As you can see, ScoutSuite does a really good job 242 242 00:09:50,310 --> 00:09:52,230 of collecting all the information and putting it 243 243 00:09:52,230 --> 00:09:54,960 into a graphical way for you to start digging through it. 244 244 00:09:54,960 --> 00:09:57,420 Alright, let's go over and take a look at Prowler. 245 245 00:09:57,420 --> 00:09:58,800 Here's a report that we generated 246 246 00:09:58,800 --> 00:10:01,410 using Prowler against sadcloud. 247 247 00:10:01,410 --> 00:10:03,660 Now, in this case, Prowler is being used 248 248 00:10:03,660 --> 00:10:06,570 to look at all the different vulnerabilities that may exist 249 249 00:10:06,570 --> 00:10:10,020 against that particular cloud inside of AWS. 250 250 00:10:10,020 --> 00:10:13,020 As you can see, this HTML file is not nearly as pretty 251 251 00:10:13,020 --> 00:10:15,690 or well laid out as the ScoutSuite report 252 252 00:10:15,690 --> 00:10:17,730 but it is something that we can get a lot 253 253 00:10:17,730 --> 00:10:19,740 of information from in one place, 254 254 00:10:19,740 --> 00:10:22,860 and it's all kind of listed in one area. 255 255 00:10:22,860 --> 00:10:24,360 As you see anything in brown, 256 256 00:10:24,360 --> 00:10:26,130 that's going to be considered informational. 257 257 00:10:26,130 --> 00:10:28,140 Anything that's green means it was passed, 258 258 00:10:28,140 --> 00:10:30,090 it was the recommended security value. 259 259 00:10:30,090 --> 00:10:32,100 Anything that's red is something that has failed 260 260 00:10:32,100 --> 00:10:34,230 and needs to have a fix applied. 261 261 00:10:34,230 --> 00:10:37,890 So let's go down here into 1.1. 262 262 00:10:37,890 --> 00:10:39,660 Avoid the use of root account. 263 263 00:10:39,660 --> 00:10:42,540 This was info, the root account was last accessed 264 264 00:10:42,540 --> 00:10:46,620 using the password key 1 and key 2 back in 2019. 265 265 00:10:46,620 --> 00:10:49,080 What this says is they shouldn't be logging in as root 266 266 00:10:49,080 --> 00:10:49,980 and since they did, 267 267 00:10:49,980 --> 00:10:53,130 that flagged it as something we want to be aware of. 268 268 00:10:53,130 --> 00:10:56,250 Number 1.2, this check, which is check 12 269 269 00:10:56,250 --> 00:10:57,083 is trying to ensure 270 270 00:10:57,083 --> 00:10:59,010 that multifactor authentication is enabled 271 271 00:10:59,010 --> 00:11:02,640 for all IAM users that have a console password. 272 272 00:11:02,640 --> 00:11:04,440 In this case, you can see 273 273 00:11:04,440 --> 00:11:07,800 that all of these particular users have passwords enabled 274 274 00:11:07,800 --> 00:11:11,250 but MFA has been disabled, so if we were making a report 275 275 00:11:11,250 --> 00:11:13,200 on this network, we would want to recommend 276 276 00:11:13,200 --> 00:11:15,480 that they start enabling MFA for all 277 277 00:11:15,480 --> 00:11:18,120 of their users because that is a higher level of security. 278 278 00:11:18,120 --> 00:11:20,610 They'll help prevent data breaches in the future. 279 279 00:11:20,610 --> 00:11:22,440 If we go to number 1.3, 280 280 00:11:22,440 --> 00:11:24,360 ensure that anytime credentials are unused 281 281 00:11:24,360 --> 00:11:26,730 for 90 days or more, they're disabled. 282 282 00:11:26,730 --> 00:11:27,690 Here you could see a couple 283 283 00:11:27,690 --> 00:11:30,300 of users have used their credentials in the last 90 days, 284 284 00:11:30,300 --> 00:11:33,480 including jdow, student 10, student 16, 285 285 00:11:33,480 --> 00:11:36,540 student 17, student 18, et cetera. 286 286 00:11:36,540 --> 00:11:38,610 All the ones listed in red haven't logged in 287 287 00:11:38,610 --> 00:11:42,240 for 90 days or more, so those should be disabled instead 288 288 00:11:42,240 --> 00:11:45,071 of having those credentials still being active. 289 289 00:11:45,071 --> 00:11:47,790 If you go to 1.4, you could see this passed, it ensures 290 290 00:11:47,790 --> 00:11:50,880 that access keys are rotated every 90 days or less 291 291 00:11:50,880 --> 00:11:53,640 and in this case, nobody has an access key that is older 292 292 00:11:53,640 --> 00:11:56,790 than 90 days, so this was considered a pass. 293 293 00:11:56,790 --> 00:11:58,980 As you continue to go through lots and lots 294 294 00:11:58,980 --> 00:12:00,060 of other information 295 295 00:12:00,060 --> 00:12:02,040 I'm not going to sit here and read it all to you 296 296 00:12:02,040 --> 00:12:05,550 but you can go and visit this report by going to sadcloud 297 297 00:12:05,550 --> 00:12:08,730 in their GitHub and then looking at this particular report. 298 298 00:12:08,730 --> 00:12:10,680 You'll notice there are IAM policies, 299 299 00:12:10,680 --> 00:12:12,210 there are cloud trail information, 300 300 00:12:12,210 --> 00:12:14,070 there is configuration information, 301 301 00:12:14,070 --> 00:12:17,460 lots and lots of information, and in this particular case 302 302 00:12:17,460 --> 00:12:20,670 there's a lot of things wrong with this particular cloud 303 303 00:12:20,670 --> 00:12:22,920 and that makes sense because sadcloud was designed 304 304 00:12:22,920 --> 00:12:24,930 to be intentionally vulnerable. 305 305 00:12:24,930 --> 00:12:27,120 The last thing I want to point out to you in terms 306 306 00:12:27,120 --> 00:12:30,450 of sadcloud is that when you're installing sadcloud, 307 307 00:12:30,450 --> 00:12:31,320 you can set it up 308 308 00:12:31,320 --> 00:12:34,560 and configure how vulnerable you want it to be. 309 309 00:12:34,560 --> 00:12:37,380 So if you go down to the configure sadcloud section 310 310 00:12:37,380 --> 00:12:40,230 of the readme, it will tell you how you can comment 311 311 00:12:40,230 --> 00:12:42,510 or uncomment different modules 312 312 00:12:42,510 --> 00:12:44,610 in the particular configuration file 313 313 00:12:44,610 --> 00:12:46,260 to determine what things will be found 314 314 00:12:46,260 --> 00:12:47,970 when you run your scans. 315 315 00:12:47,970 --> 00:12:49,980 For example, you could uncomment all 316 316 00:12:49,980 --> 00:12:54,180 of your modules inside of sadcloud/main.tf 317 317 00:12:54,180 --> 00:12:56,190 and you can then enter or edit all 318 318 00:12:56,190 --> 00:12:59,490 of the findings flags inside the Terraform image. 319 319 00:12:59,490 --> 00:13:01,140 Terraform is essentially the code 320 320 00:13:01,140 --> 00:13:03,240 for the orchestration that will allow us 321 321 00:13:03,240 --> 00:13:05,250 to create the entire environment inside 322 322 00:13:05,250 --> 00:13:08,520 of AWS with the different findings that we want. 323 323 00:13:08,520 --> 00:13:10,740 Now, if you wanted to have only some of the findings 324 324 00:13:10,740 --> 00:13:13,080 be able to be found when you're running your scans 325 325 00:13:13,080 --> 00:13:16,680 you can then uncomment only relevant sections of sadcloud 326 326 00:13:16,680 --> 00:13:18,630 and this will allow you to do something like 327 327 00:13:18,630 --> 00:13:20,910 let's just look at the storage vulnerabilities 328 328 00:13:20,910 --> 00:13:23,190 and then you could go into AWS 329 329 00:13:23,190 --> 00:13:24,600 in that environment you just created 330 330 00:13:24,600 --> 00:13:26,790 and try to fix those different vulnerabilities, 331 331 00:13:26,790 --> 00:13:28,500 run the scan again and see 332 332 00:13:28,500 --> 00:13:31,800 if the things you did to fix it have actually fixed it. 333 333 00:13:31,800 --> 00:13:34,080 This is a way that you can gain additional experience 334 334 00:13:34,080 --> 00:13:36,900 and skill in running these different cloud services 335 335 00:13:36,900 --> 00:13:38,730 by figuring out what is vulnerable, 336 336 00:13:38,730 --> 00:13:40,200 how can you properly configure them 337 337 00:13:40,200 --> 00:13:42,090 and then run that scan again. 338 338 00:13:42,090 --> 00:13:44,520 Again, all of that goes way beyond the scope 339 339 00:13:44,520 --> 00:13:47,070 of this particular exam, but I just wanted to introduce you 340 340 00:13:47,070 --> 00:13:49,830 to the way you can read these different reports inside 341 341 00:13:49,830 --> 00:13:52,860 of ScoutSuite and Prowler as you start using tools 342 342 00:13:52,860 --> 00:13:56,310 like sadcloud to gain some experience working the cloud 343 343 00:13:56,310 --> 00:13:59,013 as a vulnerability analyst or a penetration tester.