Lion Cipher Lab
Audit an AWS security group export with CIDR math and find the world in disguise
- Cloud Security
- Intermediate
- ~55 min
- Free · no account required
Why it matters
Most cloud breaches that start with the network start with one rule: SSH, Remote Desktop or a database port open to far more of the internet than anyone meant. Teams look for it by searching for 0.0.0.0/0, the address everyone knows means 'anywhere'. That search drowns in noise from the default outbound rule and misses the rules that actually bite: an IPv6 ::/0 added during a test, a /16 typed where a /24 was meant, and the two halves 0.0.0.0/1 and 128.0.0.0/1 that together are the whole internet without ever saying so. On top of that, AWS security groups have no deny rules and every group…
What you'll learn
- reading the JSON that aws ec2 describe-security-groups returns: IpPermissions, IpRanges, Ipv6Ranges, PrefixListIds, UserIdGroupPairs
- CIDR math with Python's ipaddress module: num_addresses, subnet_of, collapse_addresses, strict host-bit checks
- spotting 'the world in disguise': 0.0.0.0/1 + 128.0.0.0/1, and ::/0 hiding next to a tidy IPv4 rule
- measuring how far a CIDR is broader than the one that was meant (a /16 for a /24, a /8 for a /24)
- computing effective exposure per instance, because security groups only allow and they add up
- scoring a tool against an answer key, and measuring a naive grep the same way
- listing what a security group export cannot prove: NACLs, routes, public IPs, prefix list contents
Steps in this lab
- The words first, and a one-line recap of the beginner labs
- Open a terminal, check Python, and make a folder
- Warm up: five lines of CIDR math with the ipaddress module
- Generate the export you will audit
- BEFORE: the search everybody runs first
- Build the tool: a CIDR-aware auditor in about 160 lines
- AFTER: run it and read every finding
- Effective exposure: why one loose group wins
- Measure: the naive match and the tool against the same answer key
- Fix it on a copy, and prove the fix with the same tool
- What the export cannot tell you (the honest negatives)
- Optional: point it at a real account, read-only
- Judgment: when to reach for this, when not to, and how a pro does it