If you are looking to get hands-on experience in cloud environments and already enjoy using CloudFox, CloudFoxable is an important addition to any hacker's toolkit. CloudFoxable offers a gamified cloud hacking sandbox that allows users to find latent attack paths in an intentionally vulnerable AWS environment. Drawing inspiration from CloudGoat, flaws.cloud, and Metasploitable, CloudFoxable has a variety of challenges, flags and attack paths in a CTF format. The session provides hands-on examples of how attackers can chain together seemingly minor cloud permission issues to achieve significant compromises.

Video Summary

In this episode of the Cloud Security Podcast, Bishop Fox's Seth Art demonstrates CloudFoxable, an intentionally vulnerable AWS environment designed to help security professionals understand cloud security attack paths. The demonstration walks through how attackers can exploit common AWS misconfigurations to escalate privileges, extract sensitive data, and potentially gain complete control of cloud environments.

Art begins by introducing CloudFoxable as a training tool that simulates realistic AWS security issues, then guides viewers through using CloudFox (Bishop Fox's open-source cloud security testing tool) to identify potential vulnerabilities. The demonstration shows how attackers chain together permissions issues across multiple services like IAM, S3, Lambda, and EC2 to progressively gain greater access to the environment.

Throughout the session, Art explains the security principles behind each vulnerability, highlighting how minor misconfigurations that might pass compliance checks can combine to create serious security exposures. The demonstration emphasizes that cloud security requires understanding attack paths and permission relationships rather than focusing solely on individual settings.

Key Takeaways

1. Permission chains create unexpected risks - Minor misconfigurations across multiple AWS services can be chained together to create significant security exposures that aren't obvious when examining services individually.
2. IAM permissions require precise management - Even seemingly restrictive IAM policies can contain overlooked permissions that enable privilege escalation when combined with other services.
3. Cloud security tools enhance visibility - Tools like CloudFox help security teams identify permission relationships and potential attack paths that aren't visible through standard AWS console views.
4. Practical training bridges the knowledge gap - Hands-on experience with vulnerable environments like CloudFoxable helps security teams develop intuition for cloud security beyond what documentation alone provides.
5. Defense requires understanding offensive techniques - Organizations can better secure their cloud environments when security teams understand the methodologies attackers use to identify and exploit misconfigurations.

CloudFoxable Demo Timeline: 

00:00 Introduction 
01:55 What is cloudfoxable?
03:19 Who is cloudfoxable for?
03:39 Walkthrough Challenge 1
08:32 What is CTF?
11:41 Walkthrough 2nd Challenge
30:42 SSO
33:57 CICD Pipeline

Interested in exploring your own cloud environment’s security?

Learn more about Bishop Fox’s Cloud Penetration Testing Services →