Hands-On AWS Penetration Testing with Kali Linux

Enumerating roles

It used to be possible to use a similar attack to enumerate what roles exist in another AWS account and again, if only the AWS account ID was needed, then we could essentially brute-force all the roles that exist. Since the release by Rhino Security Labs, AWS has modified the error messages that the STS AssumeRole API call returns from the API, which means it is no longer possible to determine whether a role exists or not with this method. The iam__enum_assume_role Pacu module was written to exploit this, but no longer works due to this change.

On the plus side, a new method was discovered that allows you to enumerate roles on a cross-account basis. This method is the same as the method used to enumerate cross-account ...