Offensive Security
Cloud Penetration Test
Adversarial testing of AWS, Azure and GCP environments: IAM privilege escalation, exposed storage and services, and cross-account trust abuse.
Testing only starts after we receive written authorisation from the system owner and both sides sign off the scope and rules of engagement.
Overview
We attempt the escalation paths attackers use in the cloud, from a leaked key or compromised workload to full account takeover, within the cloud provider's testing policy.
What you get
- Executive summary for leadership
- Technical report with CVSS v3.1-rated findings
- Proof-of-concept evidence and reproduction steps
- Prioritised remediation guidance for your team
- Debrief session and one retest of fixed findings
How we work
- 01Scoping and rules of engagement: targets, test windows, accounts and signed authorisation
- 02Reconnaissance and attack-surface mapping
- 03Manual testing supported by tooling, exploiting findings safely to prove impact
- 04Reporting: risk-rated findings with evidence and fix guidance
- 05Debrief with your team, then a retest of the fixes
More Offensive Security services
- Web Application Penetration TestAuthenticated, manual testing of web applications against the OWASP Web Security Testing Guide and ASVS, including business-logic and access-control flaws.
- API Penetration TestTesting of REST and GraphQL APIs against the OWASP API Security Top 10: broken object-level authorisation, authentication, rate limiting and token handling.
- Mobile Application Penetration TestStatic and dynamic testing of iOS and Android apps against OWASP MASVS and MASTG: data storage, transport security, reverse engineering and backend APIs.
- Network Penetration TestExternal and internal infrastructure testing following PTES: exposed services, Active Directory attack paths, lateral movement and network segmentation.
- Red Team & Social EngineeringObjective-based adversary simulation mapped to MITRE ATT&CK, including phishing campaigns and assumed-breach scenarios, to test detection and response.
- Remediation RetestVerification testing of fixed findings from a previous penetration test, with an updated report and an attestation letter for customers and auditors.
Have a project to scope?
Tell us your objectives and constraints. We reply within one business day.