SSRF to Pwned
We created this beginner-friendly lab to showcase how a Server Side Request Forgery (SSRF) vulnerability can potentially be much more severe, when...
.png?height=30&name=aws_wordmark%20(1).png){kind=small}
Beginner
Hands-On Cloud Security Labs
Hands-on cloud security labs in live AWS, Azure, GCP, Kubernetes and OCI environments. Real attack and defense scenarios, with nothing to install and no cloud account needed.
Get started for free
Beginner
Pillage Exposed RDS Instances
We created this beginner-friendly lab to teach about the danger of publicly accessible Amazon Relational Database Service (RDS) instances, and how...
Beginner
Abuse Azure Logic App Automation
We all want to automate tasks, and focus on more enjoyable problems!
Abuse Cognito User and Identity Pools
We created this beginner-friendly lab to showcase how Cognito User and Identity Pool configurations can allow malicious actors to gain a foothold in...
Beginner
Abuse Dynamic Groups in Entra ID for Privilege Escalation
The lab introduces a fun scenario where our red team needs to access the secret algorithm of Mega Big Tech's social media app.
Abuse JWT Assertion in Azure
We created this intermediate-level lab to demonstrate how threat actors can use Certificate-Based Authentication (CBA), Privileged Identity...
Abuse Open Redirect for Token Stealing and Hybrid Attacks
This intermediate lab takes you end-to-end through phishing, exploiting web app flaws for OAuth2 abuse, Azure and on-premises hybrid connections...
Abuse OpenID Connect and GitLab for AWS Access
We created this lab to highlight how an overly permissive (and realistic) OpenID Connect role assumption policy can lead to threat actors gaining...
Beginner
Abuse S3 Replication and Batch Ops to Exfiltrate Data
This fun lab explores the powerful S3 features of replication and batch operations, and how they can be used by threat actors to access sensitive...
Beginner
Abuse SSTI and IAP Tunneling to Increase Access
This lab simulates a realistic penetration test of a startup's Google Cloud Platform (GCP) environment.
Abuse Unauthenticated API to Leak Data
In this fun lab, you'll pivot from external recon to internal access, exploiting a misconfigured private AWS API Gateway.
Intermediate
Access Secrets with S3 Bucket Versioning
We created this beginner-friendly lab to teach about the potential dangers of S3 bucket versioning, if the admins have not sufficiently restricted...
Beginner
Assume Privileged Role with External ID
We created this beginner-friendly lab to showcase the real-world danger of exposed configuration files, and how using production accounts for testing...
Beginner
AWS S3 Enumeration Basics
We created this beginner-friendly lab to give an introduction to one of the most popular AWS services - S3 (Simple Storage Service), and show how...
Beginner
Azure Blob Container to Initial Access
We created this beginner-friendly lab to give an introduction to one of the most popular Azure services - Blob Storage, and show how attackers can...
Azure Recon to Foothold and Profit
We created this beginner-friendly lab to showcase how threat actors can get initial access to an Azure environment, and how they can go about gaining...
Breach in the Cloud
This lab introduces a realistic cloud security incident based on suspicious AWS CloudTrail activity.
Beginner
Breach the Perimeter via Prompt Injection
In this fun lab, students will learn how prompt-injection attacks can extract secrets from AI assistants and the dangers of leaking SAS tokens and...
Build a Malware Scanning Solution in AWS
Build, break and fix! This is the way to have fun when learning cybersecurity.
Beginner
Bypass Azure MFA with Evilginx
With the hardening network perimeter, threat actors look to target users and bypass external defenses.
Bypass Azure Web App Authentication with Path Traversal
This lab highlights that securely configured Azure Web App resources can still be undone by flaws in deployed code!
Bypass Restrictions in API Gateway
This fun and beginner friendly lab provides a good methodology to follow when starting to assess the security of Application Programming Interfaces.
Beginner
Command Injection to EC2 User Data Privilege Escalation
We created this beginner-friendly lab to showcase how an OS command injection vulnerability can result in attackers compromising cloud infrastructure.
Beginner
Compromise Splunk for AWS Privilege Escalation
Learn how to leverage defensive infrastructure to achieve our objectives in this intermediate lab.
Intermediate
Compromise, Recon and Exfiltration in OCI
In this fun lab, your red team has obtained valid Oracle Cloud Infrastructure (OCI) CLI credentials issued to an auditor.
Create Custom Tooling to Explore AWS
Coding is fun, and creating our own tools allows us to better understand what is happening when we run them and of the environment in which we run...
Beginner
Detect Malicious Activity with AWS Honey Tokens
We created this beginner-friendly and hands-on lab to teach about honey tokens and how digital tripwires can be implemented natively using AWS...
Beginner
Detect Threats in the Cloud with ELK Stack
We created this beginner-friendly lab to give hands-on experience with using ELK Stack to investigate security threats in AWS.
Beginner
Emulate Storm-0501 Tactics for Cloud Compromise
In this fun lab, students will examine and emulate tradecraft associated with Storm-0501, exploit a vulnerable Function App to exfiltrate a managed...
Escalate from SSJI to EKS
In this fun EKS lab, you begin from the perspective of an external threat actor and compromise ShopNest's new Node.js customer portal running on an...
Escalate GCP privileges with Implicit Delegation
In this challenge, you will escalate your privileges by leveraging both the implicitDelegation privilege and the Service Account Token Creator role...
Escalate Privileges by IAM Policy Rollback
We created this beginner-friendly lab to showcase a potentially dangerous IAM permission, and how it could be leveraged to increase our access in an...
Beginner
Execute and Identify Credential Abuse in AWS
We created this beginner-friendly lab to showcase variety of credential abuse techniques and how they can be detected and mitigated.
Beginner
Execute Azure Credential Shuffle to Achieve Objectives
We created this beginner-friendly red team lab to showcase how threat actors can achieve their objectives in Azure by performing the "credential...
Exfiltrate Secrets via Amazon SNS Abuse
This hands-on lab guides students through the process of understanding this attack technique and implementing defenses against AWS SNS service abuse...
Intermediate
Exploit Indirect Prompt Injection for Azure Access
In this fun prompt injection lab, you'll assess a newly deployed AI assistant to see if its features can be abused to breach the perimeter...
Exploit Jenkins in the Cloud
We created this beginner-friendly lab to showcase how a cloud-based Jenkins instance can be abused due to common misconfigurations and bad practices.
Beginner
Exploit Kubernetes Overly Permissive RBAC
Join us as we explore the risks of overly permissive Role-Based Access Control (RBAC) in Kubernetes with this hands-on lab.
Exploit MFA Enablement Gaps for Resource Access
We can often come up against MFA on engagements.
Exploit SQL Injection in Azure Function App
We created this fun and beginner-friendly lab to highlight how serverless apps are not immune to vulnerabilities affecting traditional web apps.
Exploit SSRF with Gopher for GCP Initial Access
The beginner-friendly and fun web exploitation lab shows how the impact of an SSRF (Server-Side Request Forgery) vulnerability can be much more...
Exploit Weak Bucket Policies for Privileged Access
We created this beginner-friendly lab to teach about the dangers of overly permissive bucket policies, that can leak information about bucket...
Beginner
File Upload XXE to Initial Access
We created this beginner-friendly lab to showcase how an XXE vulnerability can result in attackers compromising cloud infrastructure and accessing...
Beginner
Gain Entry to GCP via GitLab Commit
We have created this beginner-friendly lab to showcase how how accidental commits to public git repositories can result in threat actors getting a...
Gain Initial Access via Social Engineering
This fun, intermediate-level lab explores a scenario where social engineering is used to gain access to a target environment.
Get Situational Awareness in AWS with Cloudfox
Cloudfox by Seth Art is a great tool for getting situational awareness in the cloud, and this hands-on lab will introduce you to some of the really...
Beginner
Hijack Orphaned S3 Buckets for Data Access
This lab showcases realistic tradecraft and techniques that we have seen on penetration tests for our clients.
Intermediate
Hunt for Secrets in Git Repos
We created this beginner-friendly lab to showcase a common issue, leaked credentials in git repositories.
Beginner
Hunt in the Cloud with Splunk
We created this beginner-friendly lab to give hands-on experience with using Splunk to investigate security threats in AWS.
Beginner
Identify IAM Breaches with CloudTrail and Athena
We created this beginner-friendly and hands-on lab to teach about AWS CloudTrail and Amazon Athena, and how these powerful services can be used to...
Beginner
Identify the AWS Account ID from a Public S3 Bucket
We created this beginner-friendly lab to teach a technique that can find an AWS account ID given a public S3 bucket, and how this can be leveraged.
Beginner
Illuminate GCP by Fuzzing IAM Permissions
The challenge revolves around leveraging the testIAMPermission method to identify IAM permissions and situational awareness.
Impersonate GCP Service Account for Privileged Access
In this scenario, you'll encounter a web server with an exposed .git directory, leading to the discovery of a GCP key file.
Infiltrate GCP via WebApp Exploitation
This intermediate-level lab involves getting hands on with web exploitation to compromise the application, underlying host and cloud environment.
Intro to AWS IAM Enumeration
We created this beginner-friendly lab to give an introduction to the AWS CLI as well as IAM user, role, group, and policy enumeration.
Beginner
Intro to Azure Recon with BloodHound
We created this beginner-friendly lab to showcase how both attackers and defenders can use BloodHound and the AzureHound collector to better...
Investigate a Ransomware Attack in AWS using Splunk
Ransomware attacks in cloud environments can be made more severe by misconfigured AWS IAM and KMS services.
Intermediate
Investigate Threats with Amazon Detective
We created this beginner-friendly and hands-on lab to teach about Amazon Detective, and how this service can enable defenders to react quickly to...
Beginner
Leverage Device Code Phishing for Initial Access
Device code phishing is a dangerous technique, both in seeming legitimate to end users and in evading detection.
Leverage Google Workspace for GCP Resource Access
In this red team lab, you'll pivot from a compromised Windows jumpbox into Google Workspace and GCP.
Leverage Insecure Storage and Backups for Profit
We created this beginner-friendly lab to showcase how backup files on accessible storage can be used to further access within a cloud environment and...
Beginner
Leverage Leaked Credentials for Pwnage
We created this beginner-friendly lab to showcase how leaked secrets can result in a malicious actor pwning a cloud environment and accessing...
Beginner
Leverage LFI for RCE and OCI Access
In this fun lab, you will abuse path traversal to read files and convert an LFI vulnerability to RCE, then use stolen OCI creds to map cloud...
Leverage Writable S3 Bucket to Steal Admin Cookie
We created this beginner-focused lab to showcase how insecure S3 bucket permissions combined with weak web server security can result in threat...
Beginner
Loot Exchange, Teams and SharePoint with GraphRunner
We created this beginner-friendly lab to showcase the GraphRunner Microsoft 365 post-exploitation toolset, and how it can be used to loot data from...
Loot Public EBS Snapshots
We created this beginner-friendly lab to teach about the dangers of public EBS snapshots, and how this can be leveraged by an attacker.
Beginner
Maneuver Through Azure Service Firewalls
Azure Service Firewalls enforce network access controls, giving them an appearance of strong security.
Passwordless Credentials for Access and Escalation
We have created this fun lab to highlight alternate forms of credential that can be abused to get access and move laterally in Azure.
Path Traversal to AWS credentials to S3
We created this beginner-friendly lab to showcase how a path traversal vulnerability can result in gaining a foothold in a cloud environment.
Beginner
Phished for Initial Access
Follow along in this beginner-friendly lab as we get hands on with phishing, token abuse and exfiltrating data from Office 365.
Pivot Through Service Accounts using Dangerous Permissions
In this lab, you'll simulate the compromise of a low-privilege service account and explore how to abuse dangerous IAM permissions to move laterally...
Plunder Azure DevOps for Cloud Credentials
Compromise a developer account with access to Azure DevOps but no permissions in Azure.
Plunder Public RDS Snapshots
We created this beginner-friendly lab to teach about the danger of public Amazon Relational Database Service (RDS) snapshots, and how this can be...
Beginner
Prevent Breaches with AWS IAM Access Analyzer
IAM is a critical component of cloud security, and it's highly recommended to get familiar with AWS IAM Access Analyzer as part of maintaining a...
Beginner
Pwn TeamCity in the Cloud
We created this beginner-friendly lab to show how a TeamCity instance installed in a cloud environment can be abused due to common bad practices and...
Beginner
Remediate Risks with Prowler and AWS Security Hub CPSM
In this lab, you will explore Prowler, an impressive open-source tool for Cloud Security Posture Management (CSPM), and report its findings to AWS...
Beginner
Remediate Vulnerabilities with Amazon Inspector
As a blue teamer, vulnerability scanning and management tools are a perfect complement to more manual red team activities.
Beginner
Reveal Hidden Files in Google Storage
We created this beginner-friendly lab to showcase how misconfigured and misused cloud storage can result in threat actors bypassing the perimeter and...
Reveal Hidden Risks with AWS Security Hub CSPM
We created this beginner-friendly and hands-on lab to teach about AWS Security Hub CSPM, and how this service can enable defenders see and prioritize...
Beginner
S3 Bucket Brute Force to Breach
We created this beginner-friendly lab to teach about the dangers of sensitive data stored on public S3 buckets, and how threat actors can discover...
Beginner
Secure Kubernetes using OPA Gatekeeper
Join us as we explore how to enhance the security and compliance of our Kubernetes clusters using Open Policy Agent (OPA) and the OPA Gatekeeper...
Secure S3 with Amazon Macie
We created this beginner-friendly and hand-on lab to teach about Amazon Macie, and how this powerful service can be used to improve the security of...
Beginner
SQS and Lambda SQL Injection
We created this beginner-friendly lab to showcase how how serverless applications can also be affected by web vulnerabilities such as SQL injection...
Intermediate
Tunnel Through GCP via JWT Forgery
This fun intermediate-level lab walks through compromising a vulnerable web application to gain code execution on the host, harvest cloud...
Unauthenticated AWS IAM Principals Enumeration
We created this beginner-friendly lab to teach various unauthenticated, cross-account IAM enumeration techniques that can be used to enumerate...
Beginner
Uncover Secrets in CodeCommit and Docker
We created this beginner-friendly lab to showcase a common issue, leaked credentials in Docker images.
Beginner
Understand Authentication Mechanisms Using Boto3
We created this lab to continue understanding how to interact with AWS services using Python3 and the boto3 module.
Intermediate
Unlock Access with Azure Key Vault
We created this beginner-friendly lab to showcase how attackers can leverage common services to move laterally in an Azure environment.
Unmask Privileged Access in Azure
We created this beginner-friendly lab to showcase how secrets can be unmasked both online and in managed systems, and how this can be leveraged to...
Escalate from Prototype Pollution to EKS Takeover
In this fun lab, you perform an external penetration test against ShopNest, a public seller portal, chaining a prototype pollution flaw into EJS template remote code execution to gain a foothold inside the environment.
Intermediate
No labs match your search.
What these cloud security labs cover
Every lab runs in a real cloud account that we provision for you. You get credentials, a scenario and an objective, and you work the problem the way you would at work: enumerate what you can see, find the weakness, and either exploit it or catch it in the logs. There is no simulation layer and no screenshots to click through, which is why the skills transfer.
The catalog covers 90 scenarios across five providers. 50 are AWS, 24 are Azure and Microsoft 365, 11 are Google Cloud and Workspace, 3 are Kubernetes and 2 are Oracle Cloud Infrastructure. Each one is built around a technique that appears in real cloud intrusions rather than a contrived puzzle, so the tools, log sources and API calls you use are the ones you will see again.
70 labs are rated beginner, which means they assume basic Linux command line familiarity and nothing else. The rest are intermediate and expect that you have already worked through the fundamentals of identity, storage and logging in at least one cloud provider.
Red team and blue team scenarios
75 labs are offensive. They cover initial access through leaked credentials, exposed storage, web application flaws and phishing, then privilege escalation and lateral movement through IAM roles, service accounts, service principals and federated trust. If you are preparing for cloud penetration testing work, this is the bulk of the catalog.
15 labs are defensive. They cover CloudTrail and Athena investigation, detection engineering with GuardDuty, Security Hub and Amazon Detective, hunting with Splunk and the ELK stack, honey tokens, and remediation with Prowler, Inspector and IAM Access Analyzer. Defensive content is the part of cloud security training that is most often missing elsewhere, and it is the part hiring managers ask about.
Working both directions is the fastest way to get good. An attack you can only describe in theory is one you will not recognize in log data during an incident, and a detection you have never tried to evade is one you will trust more than you should.
How to choose your first lab
Filter by the provider your organization actually runs, set the difficulty to beginner, and pick a scenario whose title describes something you have wondered about. Order matters less than starting. If you have no strong preference, the AWS beginner labs on storage enumeration and IAM enumeration are the usual entry point, because almost every later technique builds on understanding how identity and storage interact.
If you are working toward a role rather than a specific skill, the cloud security engineer roadmap sets out the ten areas to learn in order and links the labs that cover each one. If you want structured, guided progression with assessment, the bootcamps and certifications take the same material further and are assessed hands-on in a live cloud account.
Frequently asked questions
Do I need my own cloud account?
No. Every lab runs in an environment that Pwned Labs provisions and pays for. There is nothing to set up, no risk of running anything against infrastructure you care about, and no surprise bill.
Are the labs free?
Many of them are. Over 30 hands-on scenarios are free to play with a free account, and premium labs and the bootcamp tracks are available if you want the full catalog and guided progression.
What do I need to know before starting?
Basic Linux command line familiarity is enough for the beginner labs. Prior cloud experience helps but is not assumed, and each lab explains the services involved as you go.
Can I use these to prepare for a cloud security job?
That is what they are for. The scenarios are drawn from techniques used in real cloud intrusions, so the work you do here is the work the role involves. Being able to talk through an attack path you have actually executed, or an investigation you have actually run, is what separates candidates in interviews.
Do the labs cover defense as well as attack?
Yes. Alongside the offensive scenarios there are defensive labs on log analysis, detection engineering, threat hunting and remediation using the native tooling in each cloud, plus Splunk and the ELK stack.