Raining in the Clouds

A collection of tools that simulate cloud REST API vulnerabilities. The tools provide training for practical skill development based on real-world vulnerabilities in authorization, XSS, and SQL injection. Coverage includes OpenStack, Salesforce, and Google Cloud.

---

Prior Work

Based on instructor lead workshop materials in https://github.com/rbeede/pen-testing-cloud-apis

This material includes a self-guided walkthrough of how to setup the tools and complete some of the basic lab exercises. Additional exercises are left for practice by the reader.

Prerequisites

1. Working knowledge of OWASP Top 10 fundamentals
2. Basic skill with Linux CLI
3. Skill with HTTP MitM tools such as Burp Suite
4. For Salesforce exercises a Salesforce Developer Edition account

Where to start

Software Requirements

1. A Linux platform
   • A VM desktop guest is fine for this
     • This guide will use WSL2 (Hyper-V), but other hypervisors that can run a Linux VM can also be used
   • Ubuntu 24.04 (both x86_64 and ARM) have been tested to work
2. An HTTP MitM proxy
   • No specific software requirement, but this guide uses Burp Suite
3. Obtain copies of the following Git repos
   1. https://github.com/rbeede/pen-testing-cloud-apis
   2. https://github.com/Coalfire-Research/cazt
   3. https://github.com/rbeede/paas-cloud-goat
4. Install required dependency software
   1. gCloud CLI
      • ⚠️⚠️Do not use the snap or docker versions as it forces a read only file system that breaks the simulation tools
   2. Python 3.12.3 (should come with Ubuntu 24.04)
      • Later versions are okay, but may require some manual workarounds
   3. Salesforce CLI
   4. OpenStack Swift server & client (install instructions given later)

Education Material

Recommend opening in a new tab so you can return to this guide.

• Why Pentest Cloud APIs

  • Juniper Support Portal Exposed Customer Device Info; 2024
  • Salesforce Community Cloud data leaks shine light on misconfigurations; 2023
  • Salesforce Security Alert: API Error Exposed Marketing Data; 2018
  • A critical vulnerability was found in Google Security Operations SOAR; GCP-2025-049; 2025
  • A path traversal vulnerability in the NPM package installation process of Google Cloud Dataform; CVE-2025-9118; GCP-2025-045; 2025
  • OSSA-2019-006: Credentials API allows listing and retrieving of all users credentials; 2019

• High Level Ideas

  • Authorization Vulnerabilities
  • Cross-site Scriptiong (XSS)
  • Injection

---

Next Step

Software Configuration