Home › Cloud Security
Topic · 1 live drill Cloud Security
Cloud credential-exposure drills using simulated provider metadata APIs, no real cloud account required.
So much of cloud attack surface comes down to one move: reaching the instance metadata service and walking off with temporary credentials. From there, an SSRF or a foothold on a workload becomes account access. It's a primitive worth having in reflex memory.
PwnKata drills it safely against self-contained simulations of AWS, GCP, and Azure metadata flows — no real cloud account, no real keys, no risk. The endpoints and credential shapes vary per rep so you practice the technique itself, ready to apply it the moment a real target exposes the path.
Start drilling cloud security
Free to start — live isolated targets, a fresh variant every rep.