pacu-aws-exploitation git:20260605.476e166A

Immutable. This exact content is served forever at /api/v1/blob/c79ba1f4e19cbbb6.

---
name: pacu-aws-exploitation
description: AWS exploitation and post-compromise validation with Pacu. Use when an authorized web test yields AWS credentials, cloud metadata access, SSRF-to-AWS impact, exposed AWS keys, or an explicit request to assess an AWS account with Pacu.
allowed-tools: bash
---

# Pacu -- AWS Exploitation Framework

Pacu is an AWS exploitation framework for authorized cloud security testing. Use it only when the engagement scope explicitly includes the AWS account or when a confirmed web vulnerability produces AWS credentials or metadata access that must be validated for impact.

## When to Use

- SSRF confirms access to AWS metadata and yields temporary credentials.
- Source, logs, CI output, client bundles, or config files expose AWS access keys.
- A target owner provides AWS credentials for an authorized cloud assessment.
- You need to prove concrete AWS impact after a web finding, such as IAM privilege escalation paths, Lambda exposure, S3 access, or current principal identity.

## When Not to Use

- The target scope excludes cloud infrastructure or AWS account testing.
- You only have a public AWS account ID, ARN, bucket name, or hostname without authorization or credentials.
- You can prove the web vulnerability impact without touching AWS APIs.

## Setup

Pacu is installed as the `pacu` CLI. It stores sessions locally. Use a descriptive session name tied to the engagement or finding ID.

```bash
pacu --help
pacu --session target-ssrf-l003 --pacu-help
```

If you have temporary credentials, set them inside Pacu with `set_keys`, including the session token. Do not print secrets in the transcript; use existing credential storage or environment variables where possible.

## Core Commands

| Command | Purpose |
|---------|---------|
| `pacu --list-modules` | List modules without requiring a session |
| `pacu --session <name> --whoami` | Identify the active AWS principal |
| `pacu --session <name> --module-name <module> --module-info` | Inspect module behavior before running it |
| `pacu --session <name> --module-name <module> --exec` | Execute a module |
| `pacu --session <name> --data all` | Review locally collected data |

## Safe Workflow

1. Confirm scope before making AWS API calls.
2. Identify the principal first with `--whoami`.
3. Inspect module docs with `--module-info` before execution.
4. Prefer read-only enumeration modules before exploit or mutation modules.
5. Record the exact module, region set, and output that proves impact.

## Patterns

```bash
# List modules.
pacu --list-modules

# Identify the active principal for a named session.
pacu --session target-ssrf-l003 --whoami

# Inspect a module before running it.
pacu --session target-ssrf-l003 \
  --module-name iam__enum_permissions \
  --module-info

# Run a scoped module after confirming it is appropriate.
pacu --session target-ssrf-l003 \
  --module-name iam__enum_permissions \
  --exec
```

## Evidence Standard

For a web-security report, Pacu output is supporting evidence for the original web finding. Tie the AWS result back to the web primitive: which request exposed credentials, which Pacu principal was authenticated, and which AWS permission or data access proves impact.