Lion Cipher Lab
Chain a full AWS attack path in LocalStack — SSRF to IMDS to S3 exfil to privilege escalation to persistence — then tell the detection story
- Cloud Security
- Advanced
- ~90 min
- Free · no account required
Why it matters
Real cloud breaches are almost never one big hole. They are a CHAIN of small, individually-defensible mistakes that an attacker walks from one to the next: a web bug lets them reach the instance metadata service, which hands over the workload's temporary credentials, which happen to be allowed to read a storage bucket AND to assume a more powerful role, which can create a new access key that survives long after the original bug is patched. The 2019 Capital One breach — roughly 100 million people — was the first three links of exactly this chain. Defenders who only ever look at findings one at…
What you'll learn
- reasoning about cloud attack PATHS, not isolated misconfigurations
- running a free local AWS with LocalStack + the AWS CLI
- the SSRF->IMDS->AssumeRole->exfil->persistence kill-chain
- mapping each attacker action to a CloudTrail event and a GuardDuty finding
- the layered defenses that break the chain (IMDSv2, least privilege, boundaries, SCPs, detection)
Steps in this lab
- The mindset: attack paths, not findings
- What LocalStack is — and the one honest caveat you must hold
- Set up: LocalStack in Docker + the AWS CLI
- Build the target: a crown-jewels bucket, a workload role, and a juicier role
- Stage 1 — initial access: obtain the workload role's temporary credentials
- Stage 2 — recon and exfiltration: read the crown jewels
- Stage 3 — privilege escalation: assume the more-powerful role
- Stage 4 — persistence: plant a backdoor access key
- Switch hats — the detection story, stage by stage
- Cut the path — the layered controls, each breaking a different link
- What you did — and the reflex to keep
- Clean up