Skip to content
HackIndex.io

VPC and Network Enumeration

3 min read Created May 24, 2026 Last updated May 24, 2026

Network topology shapes what is reachable from a compromised resource. VPC peering, transit gateways, and direct connections extend the blast radius far beyond a single VPC.

Key network components to enumerate:

  • VPCs and their CIDR ranges
  • Subnets with public IP auto-assign enabled
  • Internet gateways and NAT gateways
  • VPC peering connections, especially cross-account
  • Transit gateway attachments linking multiple VPCs

VPCs

┌──(kali㉿kali)-[~]
└─$ aws ec2 describe-vpcs --profile $PROFILE --region $REGION --query 'Vpcs[*].{ID:VpcId,CIDR:CidrBlock,Default:IsDefault,Name:Tags[?Key==`Name`]|[0].Value}' --output table

Multiple VPCs in an account often indicate environment separation (dev/staging/prod). VPC peering between them is a lateral movement path.

Subnets

┌──(kali㉿kali)-[~]
└─$ aws ec2 describe-subnets --profile $PROFILE --region $REGION --query 'Subnets[*].{ID:SubnetId,VPC:VpcId,CIDR:CidrBlock,AZ:AvailabilityZone,Public:MapPublicIpOnLaunch}' --output table

MapPublicIpOnLaunch: true = instances launched here get public IPs automatically.

Internet Gateways

┌──(kali㉿kali)-[~]
└─$ aws ec2 describe-internet-gateways --profile $PROFILE --region $REGION --query 'InternetGateways[*].{ID:InternetGatewayId,VPC:Attachments[0].VpcId}' --output table

A VPC with an internet gateway attached and a route table pointing 0.0.0.0/0 to it has public internet access.

Route Tables

┌──(kali㉿kali)-[~]
└─$ aws ec2 describe-route-tables --profile $PROFILE --region $REGION --query 'RouteTables[*].{ID:RouteTableId,VPC:VpcId,Routes:Routes,Subnets:Associations[*].SubnetId}' --output json

Look for routes to igw-* (internet gateway) on 0.0.0.0/0: those subnets have outbound internet access.

VPC Peering Connections

Peering connections link VPCs: a compromised instance in one VPC may reach resources in the peer:

┌──(kali㉿kali)-[~]
└─$ aws ec2 describe-vpc-peering-connections --profile $PROFILE --region $REGION --query 'VpcPeeringConnections[*].{ID:VpcPeeringConnectionId,Requester:RequesterVpcInfo.VpcId,Accepter:AccepterVpcInfo.VpcId,Status:Status.Code}' --output table

Check if cross-account peering exists: AccepterVpcInfo.OwnerId differs from RequesterVpcInfo.OwnerId.

Transit Gateways

Transit gateways connect multiple VPCs and on-premises networks. Presence indicates a larger connected environment:

┌──(kali㉿kali)-[~]
└─$ aws ec2 describe-transit-gateways --profile $PROFILE --region $REGION
┌──(kali㉿kali)-[~]
└─$ aws ec2 describe-transit-gateway-attachments --profile $PROFILE --region $REGION

NAT Gateways

NAT gateways give private subnets outbound internet access. Useful for understanding egress paths from internal resources:

┌──(kali㉿kali)-[~]
└─$ aws ec2 describe-nat-gateways --profile $PROFILE --region $REGION --query 'NatGateways[*].{ID:NatGatewayId,VPC:VpcId,Subnet:SubnetId,State:State,PublicIP:NatGatewayAddresses[0].PublicIp}' --output table

VPC Flow Logs

Check if VPC flow logs are enabled: relevant for understanding detection coverage:

┌──(kali㉿kali)-[~]
└─$ aws ec2 describe-flow-logs --profile $PROFILE --region $REGION --query 'FlowLogs[*].{ID:FlowLogId,Resource:ResourceId,Status:FlowLogStatus,Destination:LogDestination}' --output table

ACTIVE flow logs mean network traffic is being logged to CloudWatch or S3. Adjust lateral movement techniques accordingly.

Network ACLs

NACLs are stateless filters at the subnet level: stricter than security groups and harder to bypass:

┌──(kali㉿kali)-[~]
└─$ aws ec2 describe-network-acls --profile $PROFILE --region $REGION --query 'NetworkAcls[*].{ID:NetworkAclId,VPC:VpcId,Default:IsDefault,Entries:Entries}' --output json

A default NACL allows all traffic. Custom NACLs with DENY rules on specific ports block traffic even if the security group allows it.