Fortuna

Ready to strengthen your defenses?

Let's discuss your next
security milestone
CONTACT
CASE STUDIES
CONFIDENTIAL

External cloud test reveals full AWS environment compromise

CLIENT

Confidential

SERVICE

Penetration Testing

INDUSTRY

Consulting

YEAR

2024

A leading consulting company engaged Fortuna to conduct a high-impact external penetration test on their cloud-hosted systems. The client relied heavily on AWS-based infrastructure but had never undergone a deep offensive security review of their externally exposed assets. They sought a boutique firm capable of uncovering real-world attack paths, not just surface-level vulnerabilities.

Problem

The client's security leadership suspected gaps in their cloud perimeter but lacked clarity on how an attacker might pivot from a seemingly low-impact exposure into full administrative compromise. Their environment included custom web portals, serverless functions, and internal operational tooling—creating a wide attack surface with unknown risk. They needed a partner who could think like an adversary and demonstrate actual impact, not theoretical issues.

Solution

Fortuna conducted a comprehensive external penetration test targeting the client's cloud infrastructure. Our team enumerated internet-facing services, identified a vulnerable internal web portal exposed through an open port, and chained multiple flaws () into a full AWS environment takeover. This included exploiting a local file-reading vulnerability (fuzzing of available web parameters on multiple api endpoints), extracting sensitive AWS service keys (extracting AWS security credentials from ".aws" local storage), then we reviewed the source code of same web service and found out that discovered AWS credentials can be used with high-privileged AWS lambda function. With this function we could give our token admin privileges and got control over AWS workspace. The engagement concluded with full administrative access to the client's cloud environment and creation of a new admin account—demonstrating a complete compromise path.

Key results

01

Identified a critical open-port exposure leading to internal systems

02

Exploited a local file-reading vulnerability to access sensitive AWS credentials

03

Extracted a privileged token with administrative access to Lambda

04

Executed AWS API commands as a cloud administrator

05

Demonstrated full compromise of the client's AWS infrastructure

06

Provided a prioritized remediation plan addressing systemic cloud-security weaknesses

Explore related
case studies

Client: Confidential

SERVICE

Penetration Testing

YEAR

2025

Real-world office penetration test reveals IoT to enterprise attack path

Fortuna conducted an on-site office penetration test to see if an attacker could access the client's enterprise network via physical or wireless weaknesses.

EXPLOREEXPLORE

Client: Confidential

SERVICE

Penetration Testing

YEAR

2025

Demonstrating total AD takeover from low privilege VPN access

A mid-sized consulting firm hired Fortuna to test if limited VPN access could be leveraged to exploit internal apps and escalate privileges in Active Directory.

EXPLOREEXPLORE

Let's discuss your next security or compliance milestone

Scale with securityScale with security