Exercises
Choose from over fifty different security exercises to simulate within your environment. All open source allowing you to review and customize to your liking.
Create IAM User
Creates an IAM user with ec2:DescribeRegions access and outputs the access key and secret access key ID.
Cross-Account DynamoDB Stream
Creates a cross-account accessible AWS DynamoDB table with a stream.
Cross-Account DynamoDB Table
Creates a cross-account accessible AWS DynamoDB table.
Cross-Account EFS
Creates a cross-account accessible AWS EFS.
EIP Takeover
Demonstrates the risk of Elastic IP (EIP) takeover by creating an EIP, assigning it to a Route 53 record, and then releasing it.
NameServer Delegation Takeover
Demonstrates the risk of nameserver delegation takeover by creating a subdomain and NS records, then simulating deletion.
Private GitHub Gist
Creates a private GitHub gist with specified content.
Public Backup Plan
Creates a publicly accessible AWS Backup plan and vault. Requires enabling cross-account backup.
Public Blob Container
Creates a publicly accessible Azure blob container.
Public CloudWatch Logs
Creates a publicly accessible AWS CloudWatch Logs group.
Public EBS Snapshot
Creates a public AWS EBS snapshot.
Public EC2 AMI
Creates a public AWS AMI. This exercise copies an existing public AMI, ubuntu, to the user's account and sets its launch permissions to public.
Public ECR Gallery
Creates a public AWS ECR repository.
Public ECR Repository
Creates a public ECR repository with a resource policy.
Public EFS
Creates a publicly accessible AWS EFS.
Public EventBridge Rule
Creates a publicly accessible AWS EventBridge rule with an SNS topic as the target.
Public Excel Spreadsheet
Creates a publicly accessible Excel spreadsheet in Microsoft 365.
Public GitHub Gist
Creates a public GitHub gist with specified content.
Public GitHub Repository
Creates a public GitHub repository with a specified file and content.
Public Glacier Vault
Creates a publicly accessible AWS Glacier vault.
Public Glue Database
Creates an AWS Glue database with a public resource policy. DANGER: This resource can override existing glue policy.
Public Google Calendar Event
Creates a public Google Calendar event. This allows anyone with the link to view the event.
Public Google Drive Doc
Creates a public Google Doc. This allows anyone with the link to view the document. Role allows you to specify writer, commenter, or reader publicly.
Public Google Drive Form
Creates a public Google Form. This allows anyone with the link to view the form.
Public Google Drive Sheet
Creates a public Google Sheet. This allows anyone with the link to view the sheet.
Public Google Drive Slides
Creates a public Google Slides presentation. This allows anyone with the link to view the presentation.
Public Google Group
Creates a public Google Group that anyone in the organization can join.
Public IAM Role
Creates an IAM role that allows assumption from any account.
Public KMS Key
Creates a KMS key with public access. This allows anyone to use the key for encryption and decryption.
Public Lambda Invoke
Creates a publicly accessible AWS Lambda function that returns a user-defined message.
Public Lambda Layer
Creates a publicly accessible AWS Lambda layer.
Public MediaStore Container
Creates an AWS MediaStore container with public read access.
Public OpenSearch Domain
Creates a publicly accessible AWS OpenSearch domain. NOTE: This exercise will take a few minutes to complete.
Public Powerpoint Presentation
Creates a publicly accessible Powerpoint presentation in Microsoft 365.
Public S3 Bucket GetObject
Creates a public S3 bucket with GetObject. Any objects uploaded to this bucket, provided you have the filename, allows anyone to download its objects.
Public S3 Bucket GetObject ListBucket
Creates a public S3 bucket with both GetObject and ListObject. This allows anyone to download the entire contents of the bucket.
Public S3 Bucket GetObject ListBucket PutObject
Creates a public S3 bucket with GetObject, ListBucket, and PutObject permissions. This allows anyone to upload, list, and download the entire contents of the bucket.
Public SES Identity
Creates a publicly accessible AWS SES identity for sending emails.
Public SNS Topic
Creates a public SNS topic with Publish, Subscribe, and Receive permissions. This allows anyone to publish, subscribe, and receive messages from the topic.
Public SQS Queue
Creates a public SQS queue with ReceiveMessage permissions. This allows anyone to receive messages from the queue.
Public Secrets Manager Secret
Creates a public Secrets Manager secret with GetSecretValue permissions. This allows anyone to read the secret.
Public Word Document
Creates a publicly accessible Microsoft Word document in Microsoft 365.
Root Principal Secrets Manager Secret
Creates a Secrets Manager secret with permissions for the root principal. This allows all entities in the account to access the secret.
S3 Takeover
Demonstrates the risk of S3 bucket takeover by creating a bucket for static website hosting, assigning it to a Route 53 record, and then deleting the bucket.
Third-Party Takeover
Simulates a DNS takeover scenario by creating a CNAME record pointing to a non-existent third-party service.
Create IAM User
Creates an IAM user with ec2:DescribeRegions access and outputs the access key and secret access key ID.
Cross-Account DynamoDB Stream
Creates a cross-account accessible AWS DynamoDB table with a stream.
Cross-Account DynamoDB Table
Creates a cross-account accessible AWS DynamoDB table.
Cross-Account EFS
Creates a cross-account accessible AWS EFS.
EIP Takeover
Demonstrates the risk of Elastic IP (EIP) takeover by creating an EIP, assigning it to a Route 53 record, and then releasing it.
NameServer Delegation Takeover
Demonstrates the risk of nameserver delegation takeover by creating a subdomain and NS records, then simulating deletion.
Public Backup Plan
Creates a publicly accessible AWS Backup plan and vault. Requires enabling cross-account backup.
Public CloudWatch Logs
Creates a publicly accessible AWS CloudWatch Logs group.
Public EBS Snapshot
Creates a public AWS EBS snapshot.
Public EC2 AMI
Creates a public AWS AMI. This exercise copies an existing public AMI, ubuntu, to the user's account and sets its launch permissions to public.
Public ECR Gallery
Creates a public AWS ECR repository.
Public ECR Repository
Creates a public ECR repository with a resource policy.
Public EFS
Creates a publicly accessible AWS EFS.
Public EventBridge Rule
Creates a publicly accessible AWS EventBridge rule with an SNS topic as the target.
Public Glacier Vault
Creates a publicly accessible AWS Glacier vault.
Public Glue Database
Creates an AWS Glue database with a public resource policy. DANGER: This resource can override existing glue policy.
Public IAM Role
Creates an IAM role that allows assumption from any account.
Public KMS Key
Creates a KMS key with public access. This allows anyone to use the key for encryption and decryption.
Public Lambda Invoke
Creates a publicly accessible AWS Lambda function that returns a user-defined message.