9/20/22 – by Dave Garrett – PenTesting.Cloud, a free learning platform, has released their first 4 challenges. Utilize your Linux and Cloud Computing skills to exploit vulnerabilities in a lab environment. New challenges are released every two weeks. They are setup in a CTF style, where you can earn points and compete against other members.
Most challenges require Linux and/or Python experience to solve, along with Cloud knowledge. If you don’t have access to a Linux box, you can use an EC2 instance. Users with strong Linux and shell scripting skills will be able to earn the most points.
The site was launched to promote free learning in the realms of Linux and Cloud security. It focuses on using Linux skills to discover and remediate common misconfigurations in the Cloud. The website is totally free, however you may incur a small AWS charge for the labs which require you to run them in your personal AWS sandbox account.
To get started, look at the intro challenge, which focuses on S3 and Lambda. To get started you run a shell script, which creates the vulnerable AWS resources in your sandbox AWS account. You then log in as an under privileged user and exploit one or more items to get the flag. There are several hints along with a complete walk through to guide you through this one. Formal hints and walk throughs are gradually added for the older challenges as new challenges are posted and informal hints are often given in the title, image and/or description of a challenge. For example the EC2 challenge is called “A Token of Gratitude”, and to solve it you need to get the API token from the instance metadata service.
After the intro challenge you can test your skills on an Easy (S3), Medium (CloudFormation) and Hard Challenge (EC2). The EC2 challenge is the trickiest as they instance has IMDSv2 enabled, which blocks your from seeing the temporary metadata credentials without a token.
In order to foster a positive learning environment, the easy challenges are meant to be tricky but easily solvable for a security professional, and the hard challenges are meant to be difficult for even Linux experts and seasoned penetration testers.
After you solve the challenges, check out the leader board to see where you rank. Software only one person, a user from France, has solved all 4 challenges. Each challenge is worth a different number of points, typically in the range of 5-9 for Easy, 10-29 for Medium and 30-40 for Hard.
As you work your way through the challenges you will earn different “badges”, such as “Hard Challenge Solved”, “10 Challenges Solved”, and possibly place specific badges, such as “Top 5 or Top 10”.
Coming up over the new few weeks, you will see the following challenges:
- Aurora Borealis (as you can guess from the name, its a RDS Aurora Challenge, rated medium) – 9/27
- Crash Test Dummy – AWS Glue (Medium) – 10/4
- S3 Challenge Part Deux (Easy) – 10/11
PenTesting.Cloud also accepts (and pays for) community submissions. So, if you have an idea for a lab, you can submit it and earn cash. Currently the labs are 100% AWS focused, with Azure and GCP labs planned in 2023.
CISSP holders and other certified individuals can earn CPE credits under the “self-study” category. PenTesting.Cloud recommends submitting a maximum of 1 hour for an easy challenges, 2 hours for medium, and 4 hours for hard. If there is a walk through posted, the time should be halved.
For users working on their AWS Security Certification, these labs prove a useful tools for hands on experience. Each of the labs are very different from each other and provide a unique learning experience.
Many of the labs are based on real world security incidents making PenTesting.Cloud a great way to have fun and learn new, real world skills.