Certified Cloud Penetration Tester

Name of Training: Certified Cloud Penetration Tester
Trainer: Hackers Academy
Dates: November 08-09, 2026
Time: 9:00 am - 5:00 pm
Venue: Exhibition World Bahrain
Cost: 1200 BHD

Important Note: This training is exclusively available to government entities and participants from GCC countries.

1. Short Summary

This course provides a comprehensive introduction to cloud penetration testing for beginners, covering theoretical concepts, hands-on exercises, and practical strategies to breaching the top 3 cloud vendors: Azure, AWS & GCP.

2. Course Description

As organizations increasingly adopt cloud services, securing cloud environments becomes paramount. Azure, AWS and GCP cloud platforms, are widely used across industries, making them a prime target for cyber threats. This course provides a comprehensive introduction to cloud penetration testing for beginners, covering theoretical concepts, hands-on exercises, and practical strategies to breaching the top 3 cloud vendors.

With over 20 immersive labs, learn how real attackers target AWS, Azure, and Google Cloud Platform. Through dynamic labs, guided simulations, and red-team thinking, you'll uncover the techniques adversaries use to breach, move and blend inside modern cloud environments.

You'll explore how identity, networking, automation, serverless, storage, and logging systems become both the attack surface and the battlefield.

Topics covered include:

• Enumerating services and usernames
• Variety of initial access tailored for Azure, AWS and GCP
• Bypassing defenses like Conditional Access Policies and MFA
• Using cloud native tools to blend in avoid detection
• Hacking service like storage in Azure, AWS and GCP
• Compromising compute for RCE and tokens
• Pillaging secrets from key vaults
• Abusing serverless for privilege escalation
• Identifying IAM weaknesses to create persistent backdoors
• And a lot more!

3. Course Outline

Day 1

3.1 Azure Pentesting

Introduction & Lab Setup

3.1.1 Introduction to Microsoft Azure, AWS and GGP and some of the most used services
3.1.2 Important concepts and terminology: tenant, subscription, resource groups, resource, IAM, VM, EC2, Storage, S3, etc.
3.1.3 Running the lab scripts to build up the attack scenarios

3.2 Azure Recon

3.2.1 Tenant availability and gather tenant information

• Lab: Validating tenant availability

3.2.2 Azure subdomains recon as outsider
3.2.3 Identifying Azure services in use

• Lab: Enumerating subdomains

3.2.4 User enumeration in Azure
3.2.5 Understanding error codes

• Lab: Enumerating usernames

3.3 Azure Initial Access

3.3.1 Password Spraying

• Lab: Password spraying

3.3.2 Consent Phishing

• Lab: Consent grant

3.3.3 Device Code Phishing

• Lab: Device Code Phishing

3.3.4 Adversary-in-The-Middle

• Lab: AiTM

3.4 Conditional Access Policies

3.4.1 Understanding CAPs
3.4.2 What CAPs can and cannot do
3.4.3 Understanding CAP gaps
3.4.4 CAP bypass strategies: membership, location, device, application …

• Lab: Bypass CAP

3.4.5 Lab: Bypassing CAP with stolen tokens

3.5 Azure IAM (RBAC)

3.5.1 IAM vs. Entra roles
3.5.2 Primary resource roles
3.5.3 Separation of IAM and Entra roles
3.5.4 Global admin elevation to RBAC – Case Study: Dev-1084 APT

3.6 Azure Storage Attacks

3.6.1 Storage types
3.6.2 Storage accounts
3.6.3 Storage endpoints
3.6.4 Storage Access Levels

• Lab: Enumerate and access public storage

3.6.5 Storage Account Access

• SAS
• Entra ID authorization
• Shared Keys

3.6.6 Lab: Storage access with SAS
3.6.7 Lab: Storage access with shared key

3.7 Azure Virtual Machines & IMDS

3.7.1 Azure VMs
3.7.2 Managed identities
3.7.3 IMDS

• Lab: requesting tokens from IMDS

3.8 Azure Key Vaults

3.8.1 Understanding key vaults
3.8.2 Key vault access policies
3.8.3 Key vault IAM
3.8.4 Managed IDs and Key Vaults

• Lab: Retrieving secrets from key vaults

3.8.5 Key vault tampering for persistence

3.9 AWS Pentesting

3.10 AWS Introduction

3.10.1 Intro to AWS
3.10.2 Attacker’s view and AWS APIs
3.10.3 Understanding ARNs

Common Services

• S3
• EC2
• Lambda

3.11 AWS Storage

3.11.1 Understanding S3 common usages
3.11.2 Where to look for S3 information
3.11.3 Lab: S3 enumeration

3.12 AWS Initial Access

3.12.1 Cloud attack lifecycle
3.12.2 AWS access keys
3.12.3 Searching for leaked keys
3.12.4 Lab: Finding leaked keys

Day 2

3.13 AWS Pentesting (Cont.)

3.14 AWS IAM

3.14.1 What is IAM and what does it do?
3.14.2 Policies, actions in policies and reading JSON
3.14.3 AWS Roles
3.14.4 AWS permissions
3.14.5 Roles vs. Users
3.14.6 Lab: Compromised user IAM user and role

3.15 Insider Recon

3.15.1 Understanding cloud attacker mindset
3.15.2 Important questions for post initial access
3.15.3 Important AWS cli commands to know for situational awareness
3.15.4 Lab: Post initial access, determine users, roles, policies and resources

3.16 EC2 & IMDS

3.16.1 What is EC2
3.16.2 Enumerating role assignments to EC2
3.16.3 Understanding IMDS
3.16.4 IMDS v1 vs. IMDS v2
3.16.5 Lab: Hacking an EC2 with IMDS v1 to retrieve tokens
3.16.6 Lab: Trying to hack an EC2 with MDS v2

3.17 AWS Lambda

3.17.1 Understanding serverless and Lambda
3.17.2 Examples of Lambda usage
3.17.3 Enumerating role assignments to Lambda
3.17.4 Lambda misconfigurations and exploitation

• Secrets
• Command injection
• Overly permissive roles

3.17.5 RCE example abusing Lambda function
3.17.6 Lab: Pillaging Lamda functions for secrets

3.18 AWS Privilege Escalation

3.18.1 What to look for in AWS
3.18.2 Common paths to root
3.18.3 Hunting for interesting permissions
3.18.4 Finding admin/root users
3.18.5 Lab: hunting for privileged users
3.18.6 Lab: Identifying exploitable permissions for privesc

3.19 AWS Persistence

3.19.1 Paths to persistence in AWS
3.19.2 Backdooring users
3.19.3 Backdooring access keys
3.19.4 Backdooring IAM Role trust
3.19.5 Lab: assign admin permissions to user and create backdoored access key

3.20 GCP Introduction

3.20.1 GCP intro and attacker setup
3.20.2 What is GCP and how is it different than AWS and Azure
3.20.3 The attacker’s view of GCP
3.20.4 GCP hierarchy and why it matters

GCP Common Services

• GCE
• Stroage
• SQL
• BigQuery
• Gatekeeper

3.21 GCP IAM

3.21.1 What IAM in GCP looks like
3.21.2 Understanding Principals
3.21.3 IAM Roles
3.21.4 IAM Resources and some examples
3.21.5 IAM Policies and Policy Binding
3.21.6 Service Accounts
3.21.7 Service Account Keys
3.21.8 Tokens
3.21.9 Dangerous default accounts

3.22 GCP Initial Access

GCP Attack LifeCycle

3.22.1 GCP Attack Playbook
3.22.2 Evading detection

Initial Access

3.22.3 The reality of most breaches
3.22.4 Leaked service account keys
3.22.5 Where to find keys
3.22.6 Most exploited misconfigurations
3.22.7 Default Compute Service Account example
3.22.8 RCE to short-lived tokens

3.23 Enumeration

3.23.1 Tools for post-breach recon
3.23.2 How to blend it when the dev team
3.23.3 What to avoid
3.23.4 Key questions for situation awareness
3.23.5 Key commands for gcloud cli
3.23.6 Hunting for valuable data
3.23.7 Lab: Insider enum

3.24 Cloud Storage

3.24.1 What is Google cloud storage?
3.24.2 What are high value targets in cloud storage?
3.24.3 Abusing common misconfigurations
3.24.4 Lab: list storage buckets, identify permission gaps and exfil sensitive data

3.25 Compute Engine & Metadata Exploitation

3.25.1 What is GCP compute engine
3.25.2 What is it a valuable target
3.25.3 What is the Metadata Service
3.25.4 Why target the Metadata Service
3.25.5 Legacy v0.1 endpoints and how Google fixed it
3.25.6 Modern attack vectors
3.25.7 RCE to steal tokens
3.25.8 How to use stolen tokens
3.25.9 Lab: exploit a vulnerable app to steal tokens

3.26 Secret Manager

3.26.1 What is Google Secret Manager
3.26.2 What to expect if it’s exploited
3.26.3 Secret Manager common misconfigurations
3.26.4 Lab: Listing secrets and retrieving their values

3.27 Privilege Escalation in GCP

3.27.1 GCP’s unique model
3.27.2 The concept of chained impersonations
3.27.3 Service account impersonation and how it works
3.27.4 Impersonation attack flow
3.27.5 Other privesc path
3.27.6 Lab: from low priv user to generating tokens to privesc

3.28 Persistence in GCP

3.28.1 GCP persistence TTPs: Backdooring keys, users and hijacking accounts
3.28.2 Techniques for org level persistence
3.28.3 Lab: Backdooring org with service account and new keys

3.29 BigQuery – Bonus Section if Time Allows

3.29.1 What is BigQuery
3.29.2 Why is it a valuable target
3.29.3 BigQuery common misconfigurations: permissions, datasets, service accounts
3.29.4 BigQuery enumeration
3.29.5 BigQuery exfil
3.29.6 Lab: Finding PII in BigQue

4. Difficulty Level

Beginner - The student has an interest in the topic presented and general technology knowledge that a power user or undergraduate student may have acquired.

Intermediate - The student has education and some experience in the field and familiarity with the topic being presented. The student has foundational knowledge that the course will leverage to provide practical skills on the topic.

5. Suggested Prerequisites

Students should have:

• Students are not expected to have knowledge of cloud services. However, it would help to have a basic level understanding of cyber security concepts, networking and operating systems.

6. What Students Should Bring

• Students should bring a laptop with RDP client.
• All labs are cloud based.

7. What the Trainer Will Provide

• Students will be provided with all course material. This includes over 300 slides and over 70 pages of lab manuals.
• Cloud labs will be available for each student for 90 hours usage (within 15 days from the start of the training).
• The instructors will share their own lab guides and scripts so students can replicate the setup in their private labs.

8. Trainer Bio

Tarek Naja

Tarek Naja is the founder of AstraSec.io and HackersAcademy.com. Tarek holds an MSc. in Information Security, is an international trainer who teaches at Blackhat, HiTB and other major conferences. He is also the technical advisor for GISEC, the largest security conference in the Middle East and is a previous OWASP Dubai Chapter Leader.

9. Registration Terms and Conditions

9.1 Trainings are refundable before September 21, 2026, minus a non-refundable processing fee of 100 BHD.

9.2 Between September 21, 2026 and October 21, 2026 partial refunds will be granted, equal to 50% of the course fee minus a processing fee of 100 BHD.

9.3 All trainings are non-refundable after October 21, 2026.

9.4 Training tickets may be transferred to another student. Please email us at training@defcon.org for specifics.

9.5 If a training does not reach the minimum registration requirement, it may be cancelled. In the event the training you choose is cancelled, you will be provided the option of receiving a full refund or transferring to another training (subject to availability).

9.6 Failure to attend the training without prior written notification will be considered a no-show. No refund will be given.

9.7 DEF CON Training may share student contact information, including names and emails, with the course instructor(s) to facilitate sharing of pre-work and course instructions. Instructors are required to safeguard this information and provide appropriate protection so that it is kept private. Instructors may not use student information outside the delivery of this course without the permission of the student.

9.8 By purchasing this ticket you agree to abide by the DEF CON Training Code of Conduct and the registration terms and conditions listed above.