Capstone: Full STE Engagement — From Scope to Closed Findings

Prerequisites

All STE-C01, STE-C02, and STE-C03 core cards completed.

Why This Lesson Matters

Every STE skill practised in isolation must now work together under time pressure with a real deliverable at the end. This capstone simulates a complete STE engagement: you receive a scope document, execute test cases, encounter findings, score and document them, and produce an abbreviated evaluation report. The quality of your report determines the grade.

1. Engagement Brief

System under evaluation: CloudApp v2.1 — a web application deployed on AWS Evaluation basis: CSS-CLOUD-2026 (subset of 8 controls)

Controls in scope:

CSS-C01: Public access blocks enabled on all S3 buckets
CSS-C02: IAM policies follow least privilege (no Action:*)
CSS-C03: CloudTrail enabled and multi-region
CSS-C04: IMDS v2 enforced (IMDSv1 disabled)
CSS-WEB-01: Authentication required on all API endpoints
CSS-WEB-02: SQL injection prevented in all user-controlled inputs
CSS-WEB-03: Session tokens regenerated after login
CSS-WEB-04: Security headers present on all responses

Credentials provided: AWS read-only evaluator credentials + two web app accounts (admin and viewer)

2. Recommended Execution Order

Hour 1 — Cloud posture (CSS-C01 through CSS-C04)
  Run automated checks (AWS CLI scripts from STE-K007)
  Document each control as PASS / FAIL / NEEDS-MANUAL

Hour 2 — Web application (CSS-WEB-01 through CSS-WEB-04)
  Run ZAP authenticated scan
  Triage High alerts
  Run targeted manual test cases for each control

Hour 3 — Findings and evidence
  For each FAIL: complete the STE finding template
  Capture all evidence items
  Score each finding with CVSS v3.1

Hour 4 — Report production
  Executive summary (3 paragraphs)
  Results table
  Compliance summary table
  Tier 1 remediation roadmap

3. Cloud IMDS Finding

A key test in this capstone is verifying whether IMDSv1 is disabled.

Control CSS-C04: IMDSv2 shall be enforced on all EC2 instances.

Test procedure:
  Step 1: From the web app (via SSRF if available, or via evaluator shell access):
    curl http://169.254.169.254/latest/meta-data/
    Expected: 401 (IMDSv2 requires a token header)
    FAIL: 200 (IMDSv1 still responding)

  Step 2: Check instance metadata options via AWS CLI:
    aws ec2 describe-instances --query 
      "Reservations[*].Instances[*].{ID:InstanceId,
       IMDS:MetadataOptions.HttpTokens}" --output table
    Expected: HttpTokens = required (IMDSv2 enforced)
    FAIL: HttpTokens = optional (IMDSv1 still available)

If IMDSv1 is accessible and an SSRF exists → attacker can steal IAM credentials:
  curl -H "X-SSRF-Target: http://169.254.169.254/latest/meta-data/iam/security-credentials/"
  → Returns role name → follow-up request returns AWS access key, secret, and session token
  → Critical finding: credentials allow AWS API access as the EC2 instance role

4. Deliverable Requirements

Your capstone deliverable is an abbreviated evaluation report containing:

1. Executive Summary (3 paragraphs)
2. Results Summary Table (counts per severity)
3. Compliance Summary Table (8 controls, PASS/FAIL/N/A with finding refs)
4. Findings (full template for each FAIL)
5. Tier 1 Remediation Roadmap (Critical findings only)

Scoring rubric: - Each complete finding template: 10 points - CVSS score accuracy (±0.5 of expected): 5 points per finding - Executive summary audience-appropriateness: 10 points - Compliance table accuracy: 10 points - Remediation roadmap specificity: 10 points

5. Lab

Assessment mode: ctf

challenge_spec_id: 218 — Cloud IMDS credential theft

The web application has an SSRF vulnerability and IMDSv1 is not disabled.

Task: 1. Find the SSRF parameter 2. Use it to query the IMDS endpoint for IAM credentials 3. Use the stolen credentials to list an S3 bucket 4. The bucket contains a file with the flag 5. Submit: PREFIX{flag_value}

Additionally, write a finding for CSS-C04 failure using the evidence you collected.

6. Framework Alignment

7. Further Reading

• AWS IMDS v2 Migration Guide — https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html
• HackTricks SSRF to IMDS — https://book.hacktricks.xyz/pentesting-web/ssrf-server-side-request-forgery
• CIS AWS Foundations Benchmark — Control 2.1 covers CloudTrail; multiple controls cover IMDSv2

["Execute the IMDSv2 enforcement test case against an EC2 instance using both the AWS CLI and an SSRF probe, and produce a complete FAIL finding if IMDSv1 responds", "Produce an abbreviated STE evaluation report with an executive summary, compliance table for eight controls, and complete finding templates for all failed controls", "Use stolen IMDS IAM credentials to enumerate an S3 bucket, retrieve a flag, and document the attack chain as a CVSS-scored STE finding referencing control CSS-C04"]

Engagement brief → Recommended execution order (4-hour timeline) → Cloud IMDS finding (IMDSv1 test procedure, SSRF credential theft chain) → Deliverable requirements and scoring rubric → CTF lab (IMDS credential theft, spec 218) → Framework alignment → Further reading