Hands-On AWS Penetration Testing with Kali Linux

Data exfiltration

Data exfiltration will likely work very similarly to how we escalated our privileges previously, in that we will most likely edit an existing function and exfiltrate data from it like that. There are a lot of different ways we could do this, some of which are listed here:

• Modify an existing function and exfiltrate the data that it is receiving through the "event" and "context" parameters
• Create a new function and associated trigger to respond to certain events in the AWS environment, such as in Chapter 11, Using Boto3 and Pacu to Maintain AWS Persistence where we exfiltrated credentials every time a new user was created
• Modify an existing function and place our exfiltration payload somewhere in the middle of the function ...