Pwned Labs AWS Penetration Testing

Pwned Labs tests your AWS environment the way an attacker would. We go beyond automated scanning to manually test IAM and IAM Identity Center, S3 and other data stores, EC2 and the instance metadata service, Lambda and API Gateway, ECS and EKS, and the cross-account trust relationships that connect them.

What we test

• IAM and identity: privilege escalation paths, overly permissive policies, role chaining, cross-account trust abuse and federation misconfigurations.
• Data storage: S3 bucket policies and ACLs, pre-signed URL abuse, snapshots and AMIs shared more widely than intended, and the paths data could take out of the account.
• Serverless and containers: injection into Lambda and API Gateway event payloads, secrets left in environment variables, overly permissive execution roles, ECS task roles, EKS pod identity, and access to the instance metadata service from inside a running container.

How we work

We agree the accounts, regions and services in scope before testing starts, and align the work with AWS's customer support policy for penetration testing. Testing follows PTES, OWASP and the MITRE ATT&CK Cloud matrix, from reconnaissance through exploitation and post-exploitation.

What you receive

An executive summary for stakeholders and a technical report for engineers. Each finding includes the evidence behind it, the specific AWS API calls involved, prioritized remediation guidance and the detection that should have caught the activity.

The techniques our testers use are the same ones we teach in our AWS labs and the Amazon Cloud Red Team Professional (ACRTP) certification, so the methodology is exercised against current AWS behavior.

Each engagement is scoped with you and priced through a private offer.