Path Traversal to AWS credentials to S3

This beginner-friendly lab shows how a path traversal (dot-dot-slash) vulnerability in a web application can be leveraged to gain a foothold in a cloud environment. You enumerate a Flask-based invoicing portal, exploit a file download parameter to read arbitrary files off the underlying EC2 instance, and recover AWS credentials that lead to a target S3 bucket.

Huge Logistics has hired your team to test the security of an internet-facing invoicing portal and any linked cloud infrastructure. Starting from a single IP address, you probe the web app and demonstrate the impact of the vulnerabilities you find.

• Basic Linux command line knowledge
• Basic web application knowledge
• Familiarity with Burp Suite

• Perform web application enumeration with Nmap, ffuf, and directory brute forcing
• Fingerprint a Flask application and test for Server Side Template Injection
• Identify and exploit a directory traversal vulnerability in a file download parameter
• Use Burp Suite Intruder and Repeater to fuzz traversal payloads and read files like /etc/passwd and /etc/shadow
• Attempt offline password cracking of shadow hashes with John the Ripper
• Loot an AWS credentials file from a user home directory and authenticate with the AWS CLI
• Pivot to and exfiltrate data from a target S3 bucket

Directory and path traversal remain a common class of web application flaws that can lead to information disclosure, denial of service, or remote code execution. When the exposed files include cloud credentials, a single web bug can escalate into a full cloud environment compromise.