pacu-aws-exploitation

name	pacu-aws-exploitation
description	AWS exploitation and post-compromise validation with Pacu. Use when an authorized web test yields AWS credentials, cloud metadata access, SSRF-to-AWS impact, exposed AWS keys, or an explicit request to assess an AWS account with Pacu.
allowed-tools	bash

Pacu -- AWS Exploitation Framework

Pacu is an AWS exploitation framework for authorized cloud security testing. Use it only when the engagement scope explicitly includes the AWS account or when a confirmed web vulnerability produces AWS credentials or metadata access that must be validated for impact.

When to Use

• SSRF confirms access to AWS metadata and yields temporary credentials.
• Source, logs, CI output, client bundles, or config files expose AWS access keys.
• A target owner provides AWS credentials for an authorized cloud assessment.
• You need to prove concrete AWS impact after a web finding, such as IAM privilege escalation paths, Lambda exposure, S3 access, or current principal identity.

When Not to Use

• The target scope excludes cloud infrastructure or AWS account testing.
• You only have a public AWS account ID, ARN, bucket name, or hostname without authorization or credentials.
• You can prove the web vulnerability impact without touching AWS APIs.

Setup

Pacu is installed as the pacu CLI. It stores sessions locally. Use a descriptive session name tied to the engagement or finding ID.

pacu --help
pacu --session target-ssrf-l003 --pacu-help

If you have temporary credentials, set them inside Pacu with set_keys, including the session token. Do not print secrets in the transcript; use existing credential storage or environment variables where possible.

Core Commands

Command	Purpose
pacu --list-modules	List modules without requiring a session
pacu --session <name> --whoami	Identify the active AWS principal
pacu --session <name> --module-name <module> --module-info	Inspect module behavior before running it
pacu --session <name> --module-name <module> --exec	Execute a module
pacu --session <name> --data all	Review locally collected data

Safe Workflow

1. Confirm scope before making AWS API calls.
2. Identify the principal first with --whoami.
3. Inspect module docs with --module-info before execution.
4. Prefer read-only enumeration modules before exploit or mutation modules.
5. Record the exact module, region set, and output that proves impact.

Patterns

# List modules.
pacu --list-modules

# Identify the active principal for a named session.
pacu --session target-ssrf-l003 --whoami

# Inspect a module before running it.
pacu --session target-ssrf-l003 \
  --module-name iam__enum_permissions \
  --module-info

# Run a scoped module after confirming it is appropriate.
pacu --session target-ssrf-l003 \
  --module-name iam__enum_permissions \
  --exec

Evidence Standard

For a web-security report, Pacu output is supporting evidence for the original web finding. Tie the AWS result back to the web primitive: which request exposed credentials, which Pacu principal was authenticated, and which AWS permission or data access proves impact.