attacking-serverless - Test Serverless Functions and Event Triggers
Enumerate serverless functions, inject event inputs, extract runtime credentials, test IAM privilege escalation, and assess trigger and runtime misconfigurations.
Tags
Updated: 2026-10-01Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Enumerate serverless functions
- Inject event inputs
- Extract runtime credentials
- Abuse execution IAM roles
- Test trigger misconfigurations
- Inspect runtime persistence
Inputs
- Cloud account access
- Target function identifiers
- Event source permissions
- Runtime code execution access
Outputs
- Function and trigger inventories
- Extracted credentials and secrets
- IAM privilege escalation paths
- Trigger misconfiguration findings
- Runtime persistence findings
Requirements
- AWS, Azure, GCP, or Cloudflare serverless environment
- Cloud control-plane API access