> For the complete documentation index, see [llms.txt](https://www.techwithtyler.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.techwithtyler.dev/cloud-security/capture-the-flags-ctfs/flaws.cloud.md).

# Flaws.Cloud

A walkthrough of the CTF Flaws.Cloud

{% embed url="<http://flaws.cloud>" %}

| Walkthrough Link                                                         | Summary                                                                                                                                                                                                                                                              |
| ------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [Level 1](/cloud-security/capture-the-flags-ctfs/flaws.cloud/level-1.md) | The goal is to identify the S3 bucket associated with the `flaws.cloud` and discover the sub-domain.                                                                                                                                                                 |
| [Level 2](/cloud-security/capture-the-flags-ctfs/flaws.cloud/level-2.md) | In this section, we leverage DNS to discover an S3 bucket and then exploit a misconfiguration to gain access to the bucket's contents.                                                                                                                               |
| [Level 3](/cloud-security/capture-the-flags-ctfs/flaws.cloud/level-3.md) | We discover another S3 bucket this time hosting a hidden git directory. By leveraging code scanning tools we can automate the process of quickly finding exposed AWS access keys in a previous commit. This access leads to the discovery of data and our next clue. |
| [Level 4](/cloud-security/capture-the-flags-ctfs/flaws.cloud/level-4.md) | We discover a public EBS volume containing credentials to a web server and our next clue.                                                                                                                                                                            |
| [Level 5](/cloud-security/capture-the-flags-ctfs/flaws.cloud/level-5.md) | By exploiting a Server-Side Request Forgery (SSRF) vulnerability in the webserver, we gain access to the underlying EC2 instance's credentials. This leads to accessing data and our next clue.                                                                      |
| [Level 6](/cloud-security/capture-the-flags-ctfs/flaws.cloud/level-6.md) | Using credentials discovered in the previous lab, we leverage our lambda access to piece together an API endpoint that when triggered, provides the final flag.                                                                                                      |