Skip to content
HackIndex logo

HackIndex

EC2 Instance and Security Group Enumeration

1 min read May 24, 2026

EC2 enumeration maps running compute, attached roles, network exposure, and snapshot history. Security groups define what traffic is allowed — misconfigurations here directly translate to exploitation paths.

Instances

┌──(kali㉿kali)-[~]
└─$ aws ec2 describe-instances --profile $PROFILE --region $REGION --query 'Reservations[*].Instances[*].{ID:InstanceId,Type:InstanceType,State:State.Name,IP:PublicIpAddress,PrivateIP:PrivateIpAddress,IAMRole:IamInstanceProfile.Arn,AZ:Placement.AvailabilityZone}' --output table
┌──(kali㉿kali)-[~]
└─$ aws ec2 describe-instance-attribute --instance-id $INSTANCE_ID --attribute userData --profile $PROFILE --region $REGION | jq -r '.UserData.Value' | base64 -d

Security Groups

┌──(kali㉿kali)-[~]
└─$ aws ec2 describe-security-groups --profile $PROFILE --region $REGION --query "SecurityGroups[?IpPermissions[?IpRanges[?CidrIp=='0.0.0.0/0']]].{ID:GroupId,Name:GroupName,Rules:IpPermissions}" --output json

High-value findings: ports 22, 3389, 5985, 5986, 3306, 5432, 6379, 27017 open to 0.0.0.0/0.

EBS Snapshots

┌──(kali㉿kali)-[~]
└─$ aws ec2 describe-snapshots --owner-ids self --profile $PROFILE --region $REGION --filters Name=attribute,Values=createVolumePermission --query 'Snapshots[?Public==`true`]'

Instance Metadata Service Version

┌──(kali㉿kali)-[~]
└─$ aws ec2 describe-instances --profile $PROFILE --region $REGION --query 'Reservations[*].Instances[*].{ID:InstanceId,IMDSv2:MetadataOptions.HttpTokens}' --output table 
---------------------------------------
|         DescribeInstances           |
+----------------------+--------------+
|          ID          |   IMDSv2     |
+----------------------+--------------+
|  i-0abc123456789     |  optional    |
|  i-0def987654321     |  required    |
+----------------------+--------------+

optional = IMDSv1 enabled (vulnerable to SSRF). required = IMDSv2 only.

See IMDSv1 Enabled Detection and SSRF to IMDS Credential Theft.