Attacking Cloud Service Providers
A semester-length interactive textbook on control-plane intrusion and multi-tenant isolation attacks against cloud service providers.
This book is about hacking the cloud provider itself — breaking into the control plane, defeating cross-tenant isolation, and exploiting provider-side services and trust boundaries. It is not a guide to pentesting a single customer's cloud account. The target is the provider; the prize is everyone else's tenant. If your mental model of "cloud security" is misconfigured S3 buckets, this book will rebuild it.
§Who this is for
You are a security engineer, vulnerability researcher, or red-teamer — ideally one who works (or wants to work) inside a cloud provider, where the job is to find isolation-breaking bugs before attackers do. You already know web security cold: SSRF, XXE, CSRF, request smuggling, deserialization, OAuth/OIDC are tools you own. This book does not re-teach them. What it teaches is the cloud-specific attack surface those tools unlock — and a way of thinking that turns "a parsing quirk" into "cross-tenant compromise."
§The six-part lens
Every vulnerability in this book is examined through one analytical lens, introduced in Chapter 1 and used in every chapter thereafter. It is the transferable skill the 275-case corpus exists to build.
Where does it sit?
The data plane or the control plane — and what reaching it grants you.
Which isolation fails?
Network, identity, hypervisor, namespace, account, or naming.
Whose creds run this?
Where identity is attached, and where it is trusted without re-checking.
What is shared?
A host agent, a build fleet, a front-end, a namespace — shared means blast radius.
What does the provider automate?
Automation runs with privilege. That privilege is the target.
What gets logged?
What the provider sees, what is invisible, and how attackers stay under it.
§Table of contents
§How to read this book
Chapters are cumulative — each assumes the concepts and the lens from the ones before it. Read in order the first time. Every chapter ends with an attacker's checklist, and a defender's mirror; click callouts to collapse them, and click code to copy it.
Every attack in this book is drawn from published, fixed vulnerabilities, archived from public research. Citations link to a local archived copy and the original source. This material is for authorized security research, provider-side red-teaming, and education — not for attacking systems you do not own or have permission to test.
A cloud provider's deepest promise is isolation — that millions of strangers can share the same hardware and never touch. This book is the study of how that promise breaks. Turn to Chapter 1 to begin.