https://blog.kernelstub.dev/tags/cloud-security/Recent content in Cloud Security on Prepakis Georgios | Kernelstub | Security ResearcherHugoen-USMon, 16 Feb 2026 00:00:00 +0000https://blog.kernelstub.dev/posts/a-full-infrastructure-takeover-on-gsis.gr/Mon, 16 Feb 2026 00:00:00 +0000https://blog.kernelstub.dev/posts/a-full-infrastructure-takeover-on-gsis.gr/<p><strong>Table of Contents</strong></p> <ul> <li><a href="#phase-1-massive-reconnaissance-with-skuntscan">Phase 1: Massive Reconnaissance with SkuntScan</a></li> <li><a href="#phase-2-the-exposed-configuration-that-broke-everything">Phase 2: The Exposed Configuration That Broke Everything</a></li> <li><a href="#phase-3-ftp-and-the-forgotten-server">Phase 3: FTP and the Forgotten Server</a></li> <li><a href="#phase-4-oracle-webcenter-leaks-and-ldap-access">Phase 4: Oracle webCenter Leaks and LDAP Access</a></li> <li><a href="#phase-5-hardcoded-jwt-private-key">Phase 5: Hardcoded JWT Private Key</a></li> <li><a href="#phase-6-server-status-as-a-network-mapping-tool">Phase 6: Server-Statme as a Network Mapping Tool</a></li> <li><a href="#phase-7-iis-short-names-and-aspnet-backend">Phase 7: IIS Short Names and ASP.NET Backend</a></li> <li><a href="#phase-8-domibus-424--finding-the-zero-day">Phase 8: Domibme 4.2.4 – Finding the Zero-Day</a></li> <li><a href="#phase-9-from-xxe-to-ssh-on-borisgsisgr">Phase 9: From XXE to SSH on boris.gsis.gr</a></li> <li><a href="#phase-10-axis2-admin-service--deploying-a-backdoor">Phase 10: Axis2 Admin Service – Deploying a Backdoor</a></li> <li><a href="#phase-11-privilege-escalation-to-root">Phase 11: Privilege Escalation to Root</a></li> <li><a href="#phase-12-internal-network-pivot--the-1019318024-discovery">Phase 12: Internal Network Pivot – The 10.193.18.0/24 Discovery</a></li> <li><a href="#phase-13-staging-authentix-auth-and-the-database-goldmine">Phase 13: STAGING-AUTHENTIX-AUTH and the Database Goldmine</a></li> <li><a href="#phase-14-switches-firewalls-and-control-surfaces">Phase 14: Switches, Firewalls, and Control Surfaces</a></li> <li><a href="#phase-15-15-million-citizens--what-i-found">Phase 15: 15 Million Citizens – What I Found</a></li> </ul> <h2 id="phase-1-massive-reconnaissance-with-skuntscan">Phase 1: Massive Reconnaissance with SkuntScan</h2> <p>Every engagement starts with comprehensive reconnaissance. SkuntScan, our in‑house tool, combines passive enumeration with intelligent fingerprinting. It scrapes certificate transparency logs, DNS records, web archives, and then correlates everything with IP space to build a complete map of the target.</p>https://blog.kernelstub.dev/posts/comparing-tfsec-and-checkov-for-hardening-infrastracture/Wed, 12 Nov 2025 00:00:00 +0000https://blog.kernelstub.dev/posts/comparing-tfsec-and-checkov-for-hardening-infrastracture/<h2 id="why-iac-hardening-matters">Why IaC Hardening Matters</h2> <p>Here&rsquo;s the thing about infrastructure as code that makes it both wonderful and terrifying: once you write a mistake into a Terraform module, that mistake doesn&rsquo;t stay put. It gets copied. A junior engineer finds your <code>s3-bucket</code> module in the internal registry, sees it&rsquo;s already &ldquo;battle tested,&rdquo; and reuses it in three more projects without reading past the variable names. If that module happened to leave logging disabled or granted a role <code>&quot;*&quot;</code> on <code>&quot;*&quot;</code>, you haven&rsquo;t made one mistake, you&rsquo;ve made a template for making that mistake forever.</p>