Nick Frichette
@Frichette_n
Followers
5,716
Following
1,870
Media
500
Statuses
4,931
Staff Security Researcher @datadoghq | DEF CON/Black Hat main stage speaker | he/him | OSCP OSWE | Tweets are my own | Created
~/
Joined August 2013
Don't wanna be here?
Send us removal request.
Explore trending content on Musk Viewer
WEIBO LIVE X FAYEYOKO
• 145073 Tweets
百鬼夜行
• 90824 Tweets
#西園寺さんは家事をしない
• 55622 Tweets
Martes 13
• 42550 Tweets
#HUEAreMyEverything
• 37343 Tweets
#휴닝카이가수놓은여름밤의은하수
• 36170 Tweets
ゴリラ審神者
• 35470 Tweets
シャトレーゼ
• 29366 Tweets
ガラスの仮面
• 28650 Tweets
#愛され天使ヒュニンカイ
• 21998 Tweets
D-14 TO CHANYEOL SOLO
• 21594 Tweets
OUR BAND LEADER HUENINGKAI
• 21233 Tweets
للهلال
• 16873 Tweets
さんま御殿
• 15531 Tweets
CRAZY TRACK SAMPLER
• 15247 Tweets
計画運休
• 14650 Tweets
浪川さん
• 14622 Tweets
高難易度
• 14380 Tweets
レイド戦
• 14063 Tweets
警告試合
• 13218 Tweets
高津監督
• 11541 Tweets
#インターネット老人会検定
• 10251 Tweets
横井さん
• 10111 Tweets
Pinned Tweet
My talk at Black Hat USA 2023 is now on YouTube! 😁 "Evading Logging in the Cloud: Bypassing AWS CloudTrail" is a look at various methods for evading CloudTrail logging and attacking AWS environments silently.
2
52
188
XSS in the AWS Console? XSS in the AWS Console! I recently found and disclosed two instances of XSS in the AWS console. They are now fixed and here is the writeup. It has everything you can ask for: 0days in AWS, a CSP bypass, and memes.
30
254
721
As someone involved in the AWS offsec space, I want to share why I strongly do NOT recommend the HackTricks AWS Red Team Expert course. The author of it is a plagiarist, stealing content from other creators and is directly profiting off of it through sponsorships. A 🧵
11
86
342
Exciting news! Today, I’m joining Datadog as a Senior Security Researcher! I’m super excited to raise the bar in cloud security :)
30
8
275
Today is an interesting day! I read a report about a threat actor, and for once I'm impressed! This is the first I can remember in which a TA has displayed NEW tradecraft, before researchers have shared it widely. Let's review in this 🧵
10
81
273
Some exciting news! I’ve been promoted to Staff Security Researcher! I’ll keep!pushing the boundaries of cloud security :)
29
1
259
For anyone interested, Hacking the Cloud now has a section for Capture the Flag projects! The first is, CI/CDon't, an AWS/GitLab CICD themed CTF. All you'd need is Terraform and an AWS account (it is deployed to your AWS account)
1
70
246
New cloud security research! We found a method to bypass CloudTrail logging for specific IAM actions via an undocumented API service! Attackers could perform some reconnaissance activities while being undetected.
4
100
240
It's a beautiful Sunday, so let's chat about hacking AWS environments! In this thread, I want to talk about an interesting quirk with Amazon Cognito, demo why least privilege is the most important thing in the cloud, and emphasize that mitigations aren't always enough. A 🧵
4
46
240
New cloud security research! We found a vulnerability in AWS AppSync that allowed us to trick the AppSync service to assume roles in other accounts, allowing us to access their resources.
10
93
230
I recently found a bug in the AWS API that allows you to enumerate certain permissions for a role without logging to CloudTrail. It affects 645 actions in 40 AWS services. In this thread I'll provide a short tl;dr.
7
77
213
You ever compromise an AWS account and want to run commands on the EC2 instances inside but forget the syntax? Yeah me too. Don't worry though, I've got you covered! Latest article on Hacking the Cloud is a cheat sheet on how to do this and Session Manager
1
59
183
For the past several months I've been working on a project to extract AWS API models from the console. There are a ton of "internal only" and undocumented services/operations. If you're involved in AWS security research you may find it useful.
5
33
182
This is probably the most requested page and it's finally here (well, mostly at least). Hacking The Cloud now has a list of IAM privilege escalation techniques. If you think I've missed some or you'd like to add screenshots/walkthroughs open a RP!
4
46
167
Incredible news! has hit 1,000 stars on GitHub! I really appreciate the community support and all of the amazing contributors!
4
43
155
New cloud security research! We found a method to bypass CloudTrail logging for both read AND write API actions in AWS Service Catalog! In addition, we also reported an issue with a lack of CloudTrail logging in AWS Control Tower.
4
63
150
Just a reminder that docker containers on an EC2 instance can still reach the metadata service and forgetting that makes things go boom.
6
15
143
As security researchers, we don’t often discuss failed research projects. While it may be a bit embarrassing to not succeed, there are still lessons learned from the project. In this thread, I’d like to share research I’ve been doing on-and-off on identifying AWS honeytokens. 🧵
7
33
146
Haven't used this yet, but it's too cool not to share. AWS Exploitation Framework:
2
37
148
This isn’t a subtweet at any vendor or anything, but I’m pretty sure Twitter beats most threat intel feeds. When your staff are a part of the infosec community and current events, they can inform you faster than a third party vendor.
9
21
143
I wrote up some thoughts around using stolen IAM credentials. This covers how to check if they are valid, how to use them, and covers some operational security concerns along with some potential tips for defenders to detect shady activity.
3
36
142
Added a new technique to Hacking the Cloud: Hide malicious Terraform code with ANSI escape sequences.
4
41
141
Ya know, I used to think it was crazy that the OSCP exam was 24 hours long. But at around 3:30 this morning, when I rooted the last box, the delerium caused me to become enlightened. I now understand
#TryHarder
. I am the enumeration.
13
9
135
Yesterday a gentleman asked if I knew of a way to extract IAM credentials from an AWS console session. My first instinct was to refer them to
@christophetd
's previous work on the subject. That had me looking for more though. A 🧵
2
28
129
*screaming in cloud security*
2
28
119
New on Hacking the Cloud! I started cataloging AWS IAM persistence methods, all in one place. This includes some used in the wild by real world adversaries. It's definitely not all possible methods, but it's a good start.
2
42
119
Want to get paid to commit felonies against a Fortune 40? (not really, but I hope that got your attention). My team is hiring/expanding again and we are looking for experienced Penetration Testers. Full remote too! Let me tell you why my team is neat...
6
43
104
If it's useful for anyone, I'm making my AWS API client public. This is what I used to uncover two XSS vulns in the AWS Console and is based off the silent permission enumeration research I did a while ago. I have to stress it is VERY hacky software.
2
30
100
Some exciting news! I'll be speaking at Black Hat USA in August! My talk, "Evading Logging in the Cloud: Bypassing AWS CloudTrail" was accepted! I'll do a deep dive into my research on defense evasion in CloudTrail.
7
6
101
My talk "What I Wish I Knew Before Pentesting AWS Environments" for SANS Pen Test Hackfest 2022 is now on YouTube! Check it out if you're interested in learning more ways to attack AWS environments.
2
31
95
When you find out there is an AWS Heroes program but not an AWS Villian one.
5
14
94
New AWS vulns! We found more ways to bypass AWS CloudTrail! We also describe methods Penetration Testers and Red Teamers can use to evade detection in AWS environments!
6
30
95
So the bad thing I joked about happened. Slightly panicking. I accidentally activated AWS Shield Advanced while fuzzing earlier. It’s very expensive. I’m contacting support, but worried.
Pros of fuzzing AWS APIs: Big attack surface, oddities and inconsistencies everywhere.
Cons: Boy I hope I don't accidentally spawn something that will charge me a ton of money.
2
4
39
7
11
88
Someone brought up best practices when isolating an AWS EC2 instance today which reminded me about security group connection tracking. It's an important topic to know about if you're involved in securing AWS environments. Let's talk about it!
5
27
87
My talk from
@fwdcloudsec
is on YouTube! I talked about my research on various methods that have succeeded in bypassing CloudTrail and I shared a full-bypass for the EventBridge service (now fixed).
2
25
85
I wrote a short blog article on my OSCP experiences. Enjoy :)
1
23
84
Some VERY cool research from Sam Cox of
@tracebit_com
: Using a VPC endpoint and discrepancies with logging to CloudTrail to enumerate the AWS account ID of an S3 bucket! Fantastic work!
2
20
84
New from Datadog Security Research! We found a vulnerability in AWS Amplify that exposed IAM roles associated with Amplify projects, making them assumable by anyone in the world! Both the Amplify CLI and Studio had this behavior.
1
33
83
It's official, I passed the OSCP exam on the first try after rooting all 5 exam machines! Shout out to
@offsectraining
for the incredible course and labs. Just a little while ago I never dreamed I could accomplish this.
12
5
82
New on Hacking the Cloud: A ton of additional details have been added to the "AWS Organizations Defaults & Pivoting" page by
@WebbinRoot
!
2
17
81
How about another real world attacker critique thread?
@ExpelSecurity
just published a great piece on an intrusion they took care of (Great work team). A thread. 🧵
2
24
79
Guys, my blog is static HTML behind Nginx. Leave me alone you animals.
3
9
79
My brilliant colleagues have put out a brilliant article on real world attacker techniques seen in AWS environments.
1
21
78
Just noticed that is referenced in the documentation for some Splunk cloud threat detection rules. I'm appreciative of the adoption!
0
20
75
As the year is wrapping up, I wanted to post a little bit about how Hacking the Cloud is doing. In 2021 we had over 37,277 unique visitors with over 103,042 unique page views in total. That’s around 3000 visitors per month!
2
22
76
…..if you have upwards of 100,000 secrets in a single region in a single account, please DM me. I don’t need specifics, but I’m deeply curious what you’re doing.
AWS Secrets Manager now supports up to 500,000 secrets per account per region, up from 40,000 secrets, simplifying secrets management for SaaS and PaaS applications in
#AWS
:
2
13
39
13
6
78
AWS fixed an entire category of vulnerability before I could even publish a blog or do a conference talk 😅this would have been fun for pentesters and red teamers.
4
2
76
One final
@fwdcloudsec
appreciation post: It was legitimately the best con I have ever attended. Hands down. Gathering some of the brightest minds in the cloud security community for two days of AMAZING talks. I had never been in person before and now I will never miss it.
5
14
77
Red Team/Pentest Friends, what do you use for note taking during engagements? Particularly for notes sharing with other team members.
38
4
76
Interesting use of Amazon AppStream to obfuscate your source IP address:
3
11
73
New research out of Datadog Security Labs! It's not every day that cloud security research involves a foreign government. Checkout this great research project from
@christophetd
-
0
27
72
If you’re at Black Hat tomorrow come see me talk in this giant room about bypassing CloudTrail! You’ll probably want to sit near the front 😅
2
6
73
I'll eat my hat if a security bulletin is released in the next few hours but as of right now there is not one. This is super interesting vulnerability! Kudos to those who found it! Why doesn't AWS have a public acknowledgement of it and explanation?
3
11
73
New on Hacking the Cloud: The brilliant
@__steele
shared a technique to retrieve an IAM principal's ARN from their unique identifier.
4
14
72
Hacking the Cloud has a pretty big update! We're using a better static site generator that will allow me to spend more time making content. Plus, it looks great!
0
18
70
It appears that there is a phishing campaign going around trying to steal AWS credentials. Be on the lookout in your organization! Major thank you to those sharing these in the AWS Security Forum.
5
38
68
I am so excited to share that I'll be speaking on the main stage of DEF CON next month! I'll be giving my talk "Kicking in the Door to the Cloud: Exploiting Cloud Provider Vulnerabilities for Initial Access". We'll cover some of my favorite AWS vulns!
0
8
70
I'll be speaking
@fwdcloudsec
EU this September on my research finding undocumented AWS APIs! Want a sneak peak? I'm releasing the full dataset that I've been gathering for over a year! The talk will cover how I found these and release a tool to do this!
1
12
70
Tremendous news everyone (in offsec)! There's a bypass for the new GuardDuty InstanceCredentialExfiltration finding! It's via VPC endpoints! (I caution this is with limited testing)
5
18
65
I’ll be
@fwdcloudsec
this year! I’m giving the talk “Trust Me Bro: Preexisting Trust is the New Initial Access Vector”! We’ll be kicking in the door to the cloud, covering some vulnerabilities I’ve found in AWS services to get initial access to victim environments.
2
11
68
Pen/Red Teams, if you’re not attacking CI/CD already you’re missing out. It’s RCEaaS. It will pay dividends to intimately know your org’s CI/CD stack, and know how to exploit it.
🛡️ Attacking and Securing CI/CD Pipelines
@rung
's talk covers why CI/CD pipeline security is important, relevant breaches, several attack scenarios, and how to defend
ATT&CK-like matrix for CI/CD Pipelines. Repo 👇
2
81
222
1
13
67
Yo, I don't want to fear monger right now. I feel like people smarter than me would have noticed this by now and put it on Twitter, so I may be wrong. If I'm wrong, please tell me and I will delete this thread. It appears the AWS WAF rule for log4j doesn't apply to headers.
3
15
67
New on Hacking the Cloud: I wrote a short article on using sts:GetFederationToken to maintain persistence, even when the underlying IAM access keys have been deactivated. This is a very important trick for incident responders to be aware of in AWS
1
25
65
@mx_redmond
I’d really recommend
@acloudguru
. Especially the Certified Architect Associate course. It covers all the major services in AWS. If you’re interested in offensive/defensive stuff in AWS you can check out . It’s a slowly growing repo for cloud sec stuff
3
4
65
Psst.. hey, Pentesters and Red Teamers. Do your clients/organizations use Terraform Enterprise? If it’s running in a cloud VM, you may be able to take advantage of a default config allowing you to access the instance metadata service of that host.
1
16
64
Want to mess with bypassing the new GuardDuty CredentialExfiltration finding? This project can build a setup for you! Quickly create an EC2 in a private VPC (no internet access), connect over SSM Sessions, and use the VPC Endpoints to connect to services.
2
15
64
I got an awesome email this morning, I've been accepted to the AWS Community Builders program! I'm super excited about it!
#AWScommunity
#AWSCommunityBuilders
@taylorjacobsen
5
0
65
Thank you to everyone who came to my talk at Black Hat! It was an incredible experience. I’ll be doing it again tomorrow at the
@cloudvillage_dc
! Come hear about all the ways to bypass AWS CloudTrail. There is more research coming out soon!
1
5
64
Hacking the Cloud has been updated with info about the new GuardDuty bypass as well.
0
16
63
New from Datadog Security Research! Here's the story of how tracking SNS enumeration activity across multiple customer environments led to the takedown of a phishing site that was impersonating the French government.
2
13
63
First impressions of
@fwdcloudsec
: "Wow, literally everyone in cloud security is here"
If you're looking to expand your reach for your business and want to get in front of some of the brightest minds in cloud security, consider sponsoring the event next year!
2
11
62
Did you know you can potentially escalate privileges in an AWS account with just iam:PassRole and ec2:RunInstances? Maybe this showed up during a Penetration Test, or maybe it came from an automated tool such as Cloudsplaining(which is awesome btw). Here is what it means... 🧵
3
20
62
If you missed my talk at summer camp it's now on YouTube! Evading Logging in the Cloud: Bypassing AWS CloudTrail. Major thank you to the organizers of
@cloudvillage_dc
!!
0
18
58
We are slowly winning the war on IMDSv1 🎉
3
10
57
Exciting news! In addition to Black Hat, I'll be speaking at the DEF CON Cloud Village in August! My talk is titled, "Evading Logging in the Cloud: Bypassing AWS CloudTrail". Depending on some timelines I'll likely have some not-previously-made-public things to share!
0
5
59
I'm kinda surprised there isn't a Serverless AWS Specialty cert. Obviously certs are a dubious show of knowledge (This comes from someone who has too many), but because Serverless is such a huge topic in AWS/Cloud in general you'd think they'd enshrine it with its own cert.
4
5
58
AWS recently added data event logging for SNS. This was a problem because I used sns:Publish to do a cloud version of "whoami" without logging to CloudTrail (which GetCallerIdentity does). I've updated Hacking the Cloud with a new method! Happy Hacking!
1
12
58
I’m glad AWS is taking action on this but (constructive criticism) this is a trend for AWS. You point out something is a problem, AWS looks at it and says “works as intended”, then it hits the community and AWS back pedals. It would be great if they took it seriously to start.
6
4
57
ATTENTION: THIS IS NOT A DRILL! "public facing security program" in a job listing for a TPM for a "AWS Bug Bounty". AWS Public Bug Bounty confirmed? LEEEEEETTS GOOOOOOO!!!!!!!
4
3
58
New on Hacking the Cloud - AWS Organizations Defaults: A short post on the default behavior of AWS Organizations and how compromising the management account can lead to the compromise of the entire organization.
2
19
57
Great research from the
@wiz_io
team. I think this really highlights the importance of independent cloud security research. We need more people hunting for these vulnerabilities so they can be properly disclosed before adversaries find them. Attackers ARE targeting CSPs.
⚡️💻 BREAKING: Wiz Research reveals surprising elements of the recent Microsoft Storm-0558 incident — it's much bigger than you thought!
Here's what you need to know:
7
207
418
3
8
56
An incredible study on the state of cloud security across the main cloud service providers. A ton of effort went into this study, and there is a ton to learn from here.
1
8
55
I'm going to put out a blog post soon with more details, but wanted to put this out there for anyone interested. One of the challenges with investigating undocumented AWS APIs at scale is that every single API call needs to be evaluated carefully.
1
15
54
New on Hacking the Cloud! Have you ever wanted to exploit a 3.5 year old AWS bug? Now you can! Read here about bypassing Amazon Cognito’s user enumeration controls.
1
10
53
Inspired by
@dagrz
's blog on "Getting into AWS cloud security research as a n00bcake", I'm writing a blog post on getting started in AWS security research. What questions would you have for an AWS security researcher? What do you want to know/learn about?
4
14
52
My
@fwdcloudsec
talk is on YouTube already! "Trust Me Bro: Preexisting Trust is the New Initial Access Vector" is a look at AWS vulns which allowed me to get initial access to victim AWS environments.
3
20
51
I was reminded about this talk today. It's a little over a year old but everything I mentioned should still work. I'd like to do another talk on pentesting AWS next year with some more tricks and tips.
1
14
51
New cloud security research! I found and reported an undocumented AWS API that could be used to leak the account ID of an Amplify app. AWS has since disabled the API.
2
8
51
Nothing major but I've been looking to SSM for post-exploitation type fun. Long story short, with access to an EC2 instance you can block EC2 Messages (like send-command) and SSM sessions, send arbitrary responses, or snoop on communications.
1
16
50
Me: I'm gonna learn about AWS Amplify today! 😀
10 minutes later: Why are the official docs telling me to create an IAM user with an access key? Especially when there is a functional workaround to use SSO 😠
9
4
50
I'm really surprised that Cloudsplaining has been archived. It was an incredibly useful tool for evaluating IAM policies for known problems. I can't imagine it was a burden to maintain considering its benefits.
4
4
48
I wrote a short post on abusing misconfigured resource-based policies of AWS ECR private registries. They (hopefully) come up rarely, but it can be tricky to remember the syntax to authenticate with them. This step-by-step guide makes it easy :)
0
25
47