Saturday, July 20, 2024

Cloud Penetration Testing Checklist – 2023

Cloud Penetration Testing is a method of actively checking and examining the Cloud system by simulating the attack from the malicious code.

Cloud computing is the shared responsibility of the Cloud provider and the client who earn the service from the provider.

Due to the impact of the infrastructure, Penetration Testingnot allowed in SaaS Environment.

Cloud Penetration Testing is allowed in PaaS, and IaaS with some Required coordination.

Regular Security monitoring should be implemented to monitor the presence of threats, Risks, and Vulnerabilities.

SLA contract will decide what kind of pentesting should be allowed and How often it can be done.

Important Cloud Penetration Testing Checklist:

  1. Check the Service Level Agreement and make sure that proper policy has been covered between the Cloud service provider (CSP) and Client.
  2. To maintain Governance & Compliance, check the proper responsibility between the Cloud service provider and the subscriber.
  3. Check the service level agreement Document and track the record of CSP to determine the role and responsibility to maintain the cloud resources.
  4. Check the computer and Internet usage policy and make sure it has been implemented with proper policy.
  5. Check the unused ports and protocols and make sure services should be blocked.
  6. Check the data which is stored in cloud servers is Encrypted by Default.
  7. Check the Two Factor Authentication used and validate the OTP to ensure network security.
  8. Check the SSL certificates for cloud services in the URL  and make sure certificates purchased from repudiated Certificate Authority (COMODO, Entrust, GeoTrust, Symantec, Thawte etc.)
  9. Check the Component of the access point, data center, and devices, using Appropriate security Control.
  10. Check the policies and procedures for Disclosing the data to third parties.
  11. Check if CSP offers cloning and virtual machines when Required.
  12. Check the proper input validation for Cloud applications to avoid web application Attacks such as XSS, CSRF, SQLi, etc.

Cloud Computing Attacks:


Session Riding ( Cross-Site Request Forgery)

CSRF is an attack designed to entice a victim into submitting a request, which is malicious in nature, to perform some task as the user.

Side Channel Attacks

This type of attack is unique to the cloud and potentially very devastating, but it requires a lot of skill and a measure of luck.

This attack attempts to indirectly breach a victim’s confidentiality by exploiting the fact that they are using shared resources in the cloud.

Signature Wrapping Attacks

Another type of attack is not exclusive to a cloud environment but is nonetheless a dangerous method of compromising the security of a web application.

Basically, the signature wrapping attack relies on the exploitation of a technique used in web services.

Other Attacks in Cloud Environment:

Important Considerations of Cloud Penetration Testing:

  1. Performing the Vulnerability Scanning in the available host in Cloud Environment
  2. Determine the Type of Cloud, whether it is SaaS or IaaS, or PaaS.
  3. Determine what kind of testing the Cloud Service provider permits.
  4. Check the Coordination, scheduling, and performing of the test by CSP.
  5. Performing Internal and External Pentesting.
  6. Obtain Written consent for performing the pentesting.
  7. Performing the web pentesting on the web apps/services without Firewall and Reverse Proxy.

Important Recommendation for Cloud Penetration Testing:

  1. Authenticate users with Username and Password.
  2. Secure the coding policy by giving attention to the Services Providers’ Policy.
  3. A strong Password Policy must be Advised.
  4. Change Regularly by Organization, such as user account name and a password assigned by the cloud Providers.
  5. Protect the information that is uncovered during the Penetration Testing.
  6. Password Encryption Advisable.
  7. Use centralized Authentication or single sign-on for SaaS Applications.
  8. Ensure the Security Protocols are up-to-date and Flexible.

Important Penetration Testing Tools


SOASTA CloudTest:

This suite can enable four types of testing on a single web platform: mobile functional and performance testing and web-based functional and performance testing.


LoadStorm is a load-testing tool for web and mobile applications and is easy to use and cost-effective.


BlazeMeter is used for end-to-end performance and load testing of mobile apps, websites, and APIs.


Nexpose is a widely used vulnerability scanner that can detect vulnerabilities, misconfiguration, and missing patches in a range of devices, firewalls, virtualized systems, and cloud infrastructure.


AppThwack is a cloud-based simulator for testing Android, iOS, and web apps on actual devices. It is compatible with popular automation platforms like Robotium, Calabash, UI Automation, and several others.


Latest articles

Hackers Claiming Dettol Data Breach: 453,646 users Impacted

A significant data breach has been reported by a threat actor known as 'Hana,'...

CrowdStrike Update Triggers Widespread Windows BSOD Crashes

A recent update from cybersecurity firm CrowdStrike has caused significant disruptions for Windows users,...

Operation Spincaster Disrupts Approval Phishing Technique that Drains Victim’s Wallets

Chainalysis has launched Operation Spincaster, an initiative to disrupt approval phishing scams that have...

Octo Tempest Know for Attacking VMWare ESXi Servers Added RansomHub & Qilin to Its Arsenal

Threat actors often attack VMware ESXi servers since they accommodate many virtual machines, which...

TAG-100 Actors Using Open-Source Tools To Attack Gov & Private Orgs

Hackers exploit open-source tools to execute attacks because they are readily available, well-documented, and...

macOS Users Beware Of Weaponized Meeting App From North Korean Hackers

Meeting apps are often targeted and turned into weapons by hackers as they are...

Hackers Exploiting Legitimate RMM Tools With BugSleep Malware

Since October 2023, MuddyWater, which is an Iranian threat group linked to MOIS, has...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles