Top all-time · #2672
Rhino Security Labs
Company blog · rhinosecuritylabs.comsecurity
Rhino Security Labs is the company blog at rhinosecuritylabs.com, writing about security. Since 2017, 29 different Hacker News readers have linked it 36 times, most often “AWS Privilege Escalation Vulnerabilities”. It is still writing: the last post was on 2026-09-15, and you can follow it by feed.
Too few sampled comments (10) to say how often HN recommends it.?
Why HN links it
HN readers link Rhino Security Labs' posts on AWS and cloud security, especially IAM privilege escalation and how attackers get around defences such as IP blocks and phishing scanners.
Summarised by Claude from a sample of 10 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Rhino Security Labs is a top penetration testing company specializing in cloud (AWS, GCP, Azure), network pentesting, and webapp pentesting in Seattle.
Most-linked posts?
- AWS Privilege Escalation Vulnerabilities4 people · 5 mentions · first linked 2019-12-27
- CloudGoat: The ‘Vulnerable-By-Design’ AWS Environment3 people · 3 mentions · first linked 2018-08-01
- Introducing Pacu: The Open Source AWS Exploitation Framework3 people · 3 mentions · first linked 2018-08-21
- AWS Vulnerabilities and the Attacker’s Perspective2 people · 2 mentions · first linked 2019-10-22
- Bypassing IP Based Blocking with AWS API Gateway2 people · 2 mentions · first linked 2019-08-13
What Hacker News says?
Support for your assertion: https://rhinosecuritylabs.com/cloud-security/aws-security-vu...
Comment linking /cloud-security/aws-security-vulnerabilities-perspective/
on “NordVPN confirms it was hacked”Submitted Assume the Worst: Enumerating AWS Roles Through ‘AssumeRole’ as a story · 33 points
HN discussionI love this concept of proof-of-work captchas, but there's a growing number of tools and ways to bypass IP blocks via IP rotation[1], specially after the explosion of IaaS providers. How do you intend to tackle this? [1] Some examples: https://rhinosecuritylabs.com/aws/bypassing-ip-based-blockin... https://oxylabs.io/products/real-time-crawler https://github.com/alex-miller-0/Tor_Crawler https://www.scrapinghub.com/…
Comment linking /aws/bypassing-ip-based-blocking-aws/
on “Wikimedia is moving to Gitlab”Submitted CloudGoat: The ‘Vulnerable-By-Design’ AWS Environment as a story · 5 points
HN discussionYes, that is exactly what a motivated attacker would do to avoid their phishing site getting flagged as malicious. Here is a good article about how that is accomplished: https://rhinosecuritylabs.com/social-engineering/bypassing-e...
Comment linking /social-engineering/bypassing-email-security-url-scanning/
on ““Magic links” can end up in Bing search results, rendering them useless”Submitted Penetration Testing Amazon Web Services (AWS) as a story · 4 points
HN discussionAnd? Thats not because "AWS" was like "OMG so smart", AWS is already well aware of this issue but lays the blame on "Shared Responsibility" and are likely annoyed that Salesforce, a partner of AWS< released this without communication. Honestly, my guess is there was a lapse in Salesforce somewhere, where either legal or PR didn't check this because this likely goes against Salesforce and AWS NDA for their partnershi…
Comment linking /aws/pacu-open-source-aws-exploitation-framework/
on “Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources”Submitted Abusing Microsoft Word Features for Phishing: “subDoc” as a story · 3 points
HN discussionThere are a lot of other tools in this space and people that specialize in AWS pentesting. Another popular tool is Pacu: https://rhinosecuritylabs.com/aws/pacu-open-source-aws-explo...
Comment linking /aws/pacu-open-source-aws-exploitation-framework/
on “Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources”Submitted AWS Vulnerabilities and the Attacker’s Perspective as a story · 2 points
HN discussion> Name a pentesting firm that cares about the OSCP. Here: https://rhinosecuritylabs.com/company/ lists OCSP and CISSP and a bunch of other certs. So I guess they care about that. Now, how about you name the pentesting firm that does not list any certs.
Comment linking /company/
on “Shared thoughts after 6 years in Pentesting”Submitted AWS Privilege Escalation Vulnerabilities as a story · 2 points
HN discussionAgreed, there is a large learning curve and it took me a long time to wrap my head around it. It requires a lot of knowledge and discipline, which sooner or later will create holes. For example, if you need to pass a role to a service, you'll need PassRole; if you grant it on " * ", then oops, you might have just created the opportunity for privilege escalation [1]. There's also probably issues specific to your comp…
Comment linking /aws/aws-privilege-escalation-methods-mitigation/
on “IAM is hard – Thoughts on $80M fine from the Capital One Breach”Submitted The Capital One Breach and “Cloud_breach_s3” CloudGoat Scenario as a story · 2 points
HN discussionTo be fair to the folks at Capital One, the mitigation leverages a feature that wasn't released until well after they were compromised. https://aws.amazon.com/blogs/security/defense-in-depth-open-... I would also suggest taking a look at the various articles around AWS IAM privilege escalation: https://rhinosecuritylabs.com/aws/aws-privilege-escalation-m... https://know.bishopfox.com/research/privilege-escalation-in…
Comment linking /aws/aws-privilege-escalation-methods-mitigation/
on “CapOneMe – a vulnerable cloud environment to demonstrate the Capital One breach”Submitted Pacu: The Open Source AWS Exploitation Framework as a story · 2 points
HN discussionSome others in this space: - flAWS (flaws.cloud / flaws2.cloud) by Scott Piper - CloudGoat ( https://rhinosecuritylabs.com/aws/cloudgoat-vulnerable-desig... ) by Rhino Security Labs
Comment linking /aws/cloudgoat-vulnerable-design-aws-environment/
on “CapOneMe – a vulnerable cloud environment to demonstrate the Capital One breach”Submitted Introducing Pacu: The Open Source AWS Exploitation Framework as a story · 2 points
HN discussion> I would never expect Little Snitch (my opinion) to completely block all network traffic on all levels It's very easy to say this in retrospect, having read the blog post. How many people would have said it beforehand? As far as I can tell, hardly anyone has ever said it, except the one other mentioned article from 2021: https://rhinosecuritylabs.com/network-security/bypassing-lit... Moreover, it seems that Little…
Comment linking /network-security/bypassing-little-snitch-firewall/
on “Little Snitch “denied” connections leak your IP address”Submitted CloudGoat: The ‘Vulnerable-By-Design’ AWS Environment as a story · 2 points
HN discussionSubmitted SleuthQL: SQL Injection Discovery Tool as a story · 2 points
HN discussionSubmitted Authenticated File Read Vulnerability in JasperReports (CVE-2018-5430) as a story · 2 points
HN discussionSubmitted Introducing CFire: Evading CloudFlare Security Protections as a story · 2 points
HN discussionSubmitted Unitrends Bug Hunting: Remote Code Execution (CVE-2017-7280) – Chapter 1 as a story · 2 points
HN discussionSubmitted Attacking AWS Cognito with Pacu as a story · 1 points
HN discussionSubmitted Command Injection Vulnerability in Progress Flowmon as a story · 1 points
HN discussionSubmitted Attacking AWS Cognito with Pacu as a story · 1 points
HN discussionSubmitted AWS IAM Privilege Escalation – Methods and Mitigation as a story · 1 points
HN discussionSubmitted AWS Privilege Escalation Vulnerabilities as a story · 1 points
HN discussionSubmitted Abusing VPC Traffic Mirroring in AWS as a story · 1 points
HN discussion
