Leverage Leaked Credentials for Pwnage

This foundations lab shows how leaked secrets committed to a public repository can let an attacker pwn a cloud environment and access personally identifiable information. You discover a committed .env file containing database credentials and an AWS access key, recover the AWS account ID, and reuse the password to log in to the AWS console. From there you pivot through Secrets Manager to an RDS database holding sensitive employee and dependent data.

Rumors suggest Huge Logistics has overlooked weaknesses hidden across its GitHub repositories. As a security consultant, you comb through their repos hunting for the smallest exposure others have missed.

• Basic Linux command line knowledge
• Familiarity with the AWS CLI and console
• Basic understanding of Git repositories

• Identify secrets such as .env credentials committed to a public Git repository
• Retrieve an AWS account ID from an access key with aws sts get-access-key-info
• Exploit password reuse to log in to the AWS console as an IAM user
• Retrieve database credentials from AWS Secrets Manager
• Enumerate an RDS MySQL database and extract PII from its tables
• Use SAST tools such as TruffleHog and Gitleaks to detect exposed secrets

Exposure of sensitive credentials in .env files is a common real-world issue, and accidentally committing them to shared or public repositories hands attackers everything needed to compromise a company's infrastructure. Automated scanners run by both defenders and malicious actors continuously hunt for these leaks.