Skip to content
HackIndex logo

HackIndex

AWS Pentesting Tools & Configuration

3 min read May 24, 2026

Set up your attacker machine before starting any AWS engagement. These tools cover credential management, automated auditing, manual exploitation, and scripting.

AWS CLI

Primary interface for interacting with AWS APIs. Most attack tools rely on it for credential resolution.

┌──(kali㉿kali)-[~]
└─$ pipx install awscli

Configure a named profile for each credential set:

┌──(kali㉿kali)-[~]
└─$ aws configure --profile $PROFILE
Explain command
--profile $PROFILE Name for this credential profile. Use a separate profile per engagement.

Stores credentials in ~/.aws/credentials and config in ~/.aws/config. Use --profile $PROFILE on every command or export AWS_PROFILE=$PROFILE in your shell.

Verify access and identify the current principal:

┌──(kali㉿kali)-[~]
└─$ aws sts get-caller-identity --profile $PROFILE 
{
    "UserId": "AIDA...",
    "Account": "123456789012",
    "Arn": "arn:aws:iam::123456789012:user/jdoe"
}

Confirm which identity you are operating as before continuing.

Pacu

AWS exploitation framework. Covers IAM enumeration, privilege escalation, persistence, and lateral movement modules.

┌──(kali㉿kali)-[~]
└─$ pipx install pacu

Launch and create a session:

┌──(kali㉿kali)-[~]
└─$ pacu

Import credentials from an existing AWS CLI profile:

┌──(kali㉿kali)-[~]
└─$ import_keys $PROFILE

List available modules:

┌──(kali㉿kali)-[~]
└─$ ls

Pacu stores session data locally. Use a separate named session per engagement.

ScoutSuite

Multi-cloud security auditing tool. Produces an HTML report of misconfigurations across IAM, EC2, S3, RDS, Lambda, and more.

┌──(kali㉿kali)-[~]
└─$ pipx install scoutsuite

Run against an AWS account:

┌──(kali㉿kali)-[~]
└─$ scout aws --profile $PROFILE

Report lands in scoutsuite-report/. Use it as a map for manual follow-up — not as a final deliverable. Findings are categorized by severity and service.

Prowler

Security assessment tool with CLI-focused output. Maps findings to CIS, NIST, and other frameworks.

┌──(kali㉿kali)-[~]
└─$ pipx install prowler

Full assessment:

┌──(kali㉿kali)-[~]
└─$ prowler aws --profile $PROFILE

Scope to specific services:

┌──(kali㉿kali)-[~]
└─$ prowler aws --profile $PROFILE -s iam s3 ec2
Explain command
-s iam s3 ec2 Limit scan to specific AWS services.

Use -M csv or -M json for machine-readable output. Useful for rapid gap analysis on large accounts before manual work.

enumerate-iam

Brute-forces allowed IAM actions for a credential set — identifies what actions are permitted without needing direct policy access.

┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/andresriancho/enumerate-iam
┌──(kali㉿kali)-[~]
└─$ cd enumerate-iam
┌──(kali㉿kali)-[~]
└─$ python3 -m venv .venv && source .venv/bin/activate
┌──(kali㉿kali)-[~]
└─$ pip install -r requirements.txt
┌──(kali㉿kali)-[~]
└─$ python3 enumerate-iam.py --access-key $AWS_ACCESS_KEY_ID --secret-key $AWS_SECRET_ACCESS_KEY --session-token $AWS_SESSION_TOKEN
Explain command
--access-key $AWS_ACCESS_KEY_ID AWS access key ID to test.
--secret-key $AWS_SECRET_ACCESS_KEY AWS secret access key.
--session-token $AWS_SESSION_TOKEN Session token for temporary credentials. Omit for long-term keys.

aws_consoler

Converts temporary AWS credentials into a signed console URL. Useful for confirming access level or demonstrating impact.

┌──(kali㉿kali)-[~]
└─$ pipx install aws-consoler

Generate a console URL from a named profile:

┌──(kali㉿kali)-[~]
└─$ aws_consoler -p $PROFILE
Explain command
-p $PROFILE AWS CLI profile name to generate a console URL for.

Output is a browser-ready URL valid for a short session. Does not work with long-term IAM user keys — requires session credentials.

boto3

Python SDK for custom enumeration scripts and automation beyond what CLI tooling covers.

┌──(kali㉿kali)-[~]
└─$ python3 -m venv .venv && source .venv/bin/activate
┌──(kali㉿kali)-[~]
└─$ pip install boto3

Always use an explicit session with a named profile to avoid ambient credential bleed between engagements:

import boto3

session = boto3.Session(profile_name="$PROFILE")
iam = session.client("iam")
response = iam.list_users()