Add novel cloud attack techniques across AWS/GCP/Azure service pages

[carlospolop]

Summary

Adds accurate, previously-undocumented cloud attack techniques to existing per-service pages across AWS, GCP, and Azure. These were surfaced while building the ARTE/GRTE/AzRTE hands-on training courses; each addition was cross-checked against the current pages and only genuinely-absent primitives were added.

All changes are insert-only — no existing sections were rewritten or reordered, the top/bottom {{#include ... hacktricks-training.md}} banners are preserved on every page, and the existing <sup>/numbered ## References systems were left untouched (new prose uses plain inline links where it cites at all).

Techniques added

AWS

• RDS post-ex — read the RDS-managed master password straight from Secrets Manager (describe-db-instances/-clusters → MasterUserSecret.SecretArn → secretsmanager:GetSecretValue), no snapshot/restore needed
• Lightsail persistence — non-expiring bucket access keys (create-bucket-access-key) that survive IAM revocation / user deletion
• EventBridge Scheduler — UpdateSchedule/DeleteSchedule disruption (DoS) and target-hijack/data-redirect

GCP

• Cloud Scheduler — jobs.delete / jobs.pause disruption of dependent automation
• App Engine persistence — cron.yaml self-triggering execution as the app service account (X-Appengine-Cron: true)

Azure

• Key Vault — Event Grid SecretNewVersionCreated exfil, offline backup retention, backdoor data-plane principal, certificate/PFX export to impersonate
• Cosmos DB — account discovery by DNS/endpoint-suffix sweep
• Service Bus — off-tenant access via a leaked SAS connection string; catch-all (1=1) subscription rule for durable message siphoning
• Queue — message injection as a pivot into a downstream consumer's managed identity
• SQL — "Allow Azure services" (0.0.0.0) as a cross-tenant connect path with leaked creds
• VM / Network — boot-diagnostics log secret harvest; NSG-rule/route-table pivot; SSRF→IMDS token theft (unauth)
• Function Apps — $IDENTITY_ENDPOINT managed-identity token theft; full storage-account pivot via AzureWebJobsStorage
• Virtual Desktop — rogue session-host injection via retrieveRegistrationToken; IMDS token theft; FSLogix profile persistence
• Cloud Shell persistence — $MSI_ENDPOINT Microsoft Graph tokens; ~/.azure/ cached-token harvest
• Container Registry unauth — anonymous OCI v2 /_catalog & /tags/list enumeration; leaked-credential entry against the public endpoint
• Entra ID — federated identity credential (FIC) as a secretless backdoor

Notes

17 files changed, +358 lines. Code fences balanced on every page. Several proposed items were intentionally skipped because the target page already documented the same primitive (e.g. Cosmos server-side trigger backdoor & MI-assign, FOCI refresh-token pivoting).

🤖 Generated with Claude Code