Daily Blog #673: Working AWS EBS Blocks

Working AWS EBS Blocks - Hacking Exposed Blog by David Cowen

Hello Reader,
     In the yesterdays blog we tested out the AWS Direct EBS Block API. This allowed us to extract any block we choose from a AWS EBS Snapshot. In the test kitchen below we go deeper, looking into how many 512 sectors make up a Snapshot block (1024) and parse out the MBR to show how to work with the data thats retrieved.

We then ended the recording with some questions we need to answer:
1. The snapshot block index had gaps, did I not make a full snapshot? We will have to experiment and find out
2. Looking quickly at my cloudtrail logs I didn't see my API actions, so tomorrow we will use AWS Glue to crawl my cloudtrail logs and search for the activity we've created.

See you tomorrow and until then you can watch the video below:

Post a Comment