PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How Hackers Can Help Reduce Your Organization's Application Risk on AWS

hackerone.com | blog | #cloud | #cloud-security | #aws | #ctf | #hackerone | #ssrf | #misconfiguration | #panel
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

HackerOne and AWS experts discuss how SSRF and cloud misconfiguration create serious risk, sharing CTF lessons and noting SSRF bounties rose 103% as cloud metadata services expand the attack surface.
Published
Collected

Related coverage

blog · netspi.com
Stay Ahead of Cloud Threats: Introducing Azure and AWS Security Reviews
Discover how NetSPI's Azure & AWS Configuration Reviews provide continuous visibility, risk identification, and actionable insights to secure your cloud environments.
blog · vercel.com
Mitigating Denial of Wallet risks with Vercel
Protect against Denial of Wallet (DoW) attacks with Vercel. DoW exploits cloud scalability to inflate costs. Vercel provides solutions like budget alerts, spend limits, and anomaly detection to safeguard workloads and maintain financial stability.
blog · blog.sentry.security
DEFCON 32 Adversary Village Red Teaming Panel
Recap of the DEF CON 32 Adversary Village panel 'Red Teaming is Broken' with experts from MITRE, Google, AWS and Sentry on making red team exercises more effective, focused and cost-efficient.
blog · wiz.io
A security community success story of mitigating a misconfiguration
The story of fixing a common misconfiguration: GitHub Actions OIDC trust policies missing their 'sub' condition let anyone assume AWS roles, until coordinated research pushed defaults to change.
blog · vercel.com
Introducing Vercel Firewall and Vercel Secure Compute
Vercel Secure Compute and Vercel Firewall for enhanced protection of your applications on the frontend cloud
blog · netspi.com
Overcome Cloud Security Challenges with Purpose-Built Cloud Penetration Testing
Outlines five cloud security challenges—shadow IT, attacker-defender resource asymmetry, catastrophic misconfigurations—and argues purpose-built cloud penetration testing is the way to address them.
Back