ペンテストの手順

aws sts get-caller-identity --query '{Account:Account,Arn:Arn}'

{
    "Account": "<検証アカウント ID>",
    "Arn": "arn:aws:iam::<検証アカウント ID>:user/<ユーザー名>"
}

terraform version

Terraform v1.12.2
on linux_amd64

aws --version

aws-cli/2.38.1 Python/3.14.6 Linux/6.6.87.2-microsoft-standard-WSL2 exe/x86_64.ubuntu.22

git clone https://github.com/tatsuyaw/security-agent-lab.git

Cloning into 'security-agent-lab'...
Receiving objects: 100% (122/122), 42.82 KiB | 3.57 MiB/s, done.
Resolving deltas: 100% (40/40), done.

cd ~/security-agent-lab/terraform/public-method/dns-zone
terraform init

Initializing provider plugins...
- Installing hashicorp/aws v6.<x>...

Terraform has been successfully initialized!

cp terraform.tfvars.example terraform.tfvars

account_id = "<検証アカウント ID>"   # apply 先のアカウント。これ以外のアカウントには apply できない安全装置になる
profile    = "<プロファイル名>"       # 使う AWS CLI のプロファイル
zone_name  = "lab.infra.jp"        # 委任するサブドメイン。保有ドメインの配下にする

terraform plan -out=tfplan

Plan: 1 to add, 0 to change, 0 to destroy.

terraform apply tfplan

aws_route53_zone.lab: Creating...
aws_route53_zone.lab: Still creating... [00m10s elapsed]
aws_route53_zone.lab: Still creating... [00m20s elapsed]
aws_route53_zone.lab: Still creating... [00m30s elapsed]
aws_route53_zone.lab: Creation complete after 32s [id=<委任ゾーンの ID>]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Outputs:

name_servers = tolist([
  "ns-<数字>.awsdns-<数字>.com",
  "ns-<数字>.awsdns-<数字>.net",
  "ns-<数字>.awsdns-<数字>.org",
  "ns-<数字>.awsdns-<数字>.co.uk",
])
zone_id = "<委任ゾーンの ID>"
zone_name = "lab.infra.jp"

aws route53 get-hosted-zone --id <委任ゾーンの ID> \
  --query '{Name:HostedZone.Name,Private:HostedZone.Config.PrivateZone,NameServers:DelegationSet.NameServers}'

{
    "Name": "lab.infra.jp.",
    "Private": false,
    "NameServers": [
        "ns-<数字>.awsdns-<数字>.com",
        "ns-<数字>.awsdns-<数字>.net",
        "ns-<数字>.awsdns-<数字>.co.uk",
        "ns-<数字>.awsdns-<数字>.org"
    ]
}

dig NS lab.infra.jp +short

ns-<数字>.awsdns-<数字>.com.
ns-<数字>.awsdns-<数字>.net.
ns-<数字>.awsdns-<数字>.org.
ns-<数字>.awsdns-<数字>.co.uk.

cd ~/security-agent-lab/terraform/public-method/network-app
terraform init

Initializing provider plugins...
- Installing hashicorp/aws v6.<x>...
- Installing hashicorp/random v3.<x>...

Terraform has been successfully initialized!

cp terraform.tfvars.example terraform.tfvars

python3 -m pip download -d wheels --only-binary=:all: --python-version 3.9 \
  --implementation cp --abi cp39 --platform manylinux2014_x86_64 \
  --require-hashes -r ../../../app/requirements.txt
ls wheels

blinker-1.9.0-py3-none-any.whl
click-8.1.8-py3-none-any.whl
flask-3.1.3-py3-none-any.whl
gunicorn-23.0.0-py3-none-any.whl
importlib_metadata-8.7.1-py3-none-any.whl
itsdangerous-2.2.0-py3-none-any.whl
jinja2-3.1.6-py3-none-any.whl
markupsafe-3.0.4-cp39-cp39-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl
packaging-26.3-py3-none-any.whl
werkzeug-3.1.9-py3-none-any.whl
zipp-3.23.1-py3-none-any.whl

terraform plan -out=tfplan

Plan: 60 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + target_fqdn = "pentest.lab.infra.jp"
  + target_url  = "https://pentest.lab.infra.jp"
  + waf_mode    = "agent-first"

terraform apply tfplan

aws_vpc.lab: Creating...
...
aws_acm_certificate.app: Creation complete after 8s [id=arn:aws:acm:ap-northeast-1:<検証アカウント ID>:certificate/<証明書 ID>]
aws_route53_record.acm_validation["pentest.lab.infra.jp"]: Creation complete after 32s [id=...]
aws_acm_certificate_validation.app: Creation complete after 1s [id=<検証完了時刻>]
module.endpoints.aws_vpc_endpoint.ssm["ec2messages"]: Creation complete after 1m24s [id=vpce-<ID>]
module.vulnapp.aws_instance.app: Creation complete after 13s [id=<対象アプリのインスタンス ID>]
aws_lb.app: Creation complete after 2m22s [id=arn:aws:elasticloadbalancing:ap-northeast-1:<検証アカウント ID>:loadbalancer/app/sa-pub-alb/<ID>]
aws_lb_listener.https: Creation complete after 0s [id=...]
aws_route53_record.app: Creation complete after 32s [id=<委任ゾーンの ID>_pentest.lab.infra.jp_A]
aws_wafv2_web_acl.app: Creation complete after 2s [id=<Web ACL の ID>]
aws_wafv2_web_acl_association.alb: Creation complete after 39s [id=...]

Apply complete! Resources: 60 added, 0 changed, 0 destroyed.

Outputs:

alb_dns_name = "sa-pub-alb-<数字>.ap-northeast-1.elb.amazonaws.com"
app_instance_id = "<対象アプリのインスタンス ID>"
custom_header_name = "X-Pentest-Token"
custom_header_value = <sensitive>
flow_log_group_name = "/vpc/flow-logs/sa-pub-app"
target_fqdn = "pentest.lab.infra.jp"
target_url = "https://pentest.lab.infra.jp"
waf_log_group_name = "aws-waf-logs-sa-pub-app"
waf_mode = "agent-first"
web_acl_arn = "arn:aws:wafv2:ap-northeast-1:<検証アカウント ID>:regional/webacl/sa-pub-app/<Web ACL の ID>"

curl -sf --retry 3 --retry-all-errors "https://crt.sh/?q=pentest.lab.infra.jp&output=json" | python3 -c 'import sys,json; [print(e["not_before"], e["issuer_name"][:40], e["name_value"]) for e in json.load(sys.stdin)]'

<発行時刻> C=US, O=Amazon, CN=Amazon RSA 2048 M0x pentest.lab.infra.jp

aws wafv2 list-web-acls --scope REGIONAL \
  --query 'WebACLs[?Name==`sa-pub-app`].{Name:Name,Id:Id,ARN:ARN}' \
  --region ap-northeast-1

[
    {
        "Name": "sa-pub-app",
        "Id": "<Web ACL の ID>",
        "ARN": "arn:aws:wafv2:ap-northeast-1:<検証アカウント ID>:regional/webacl/sa-pub-app/<Web ACL の ID>"
    }
]

aws wafv2 get-web-acl --scope REGIONAL --name sa-pub-app --id <Web ACL の ID> \
  --query 'WebACL.{Default:DefaultAction,Rules:Rules[].{P:Priority,Name:Name}}' \
  --region ap-northeast-1

{
    "Default": {
        "Block": {}
    },
    "Rules": [
        { "P": 0, "Name": "allow-pentest-agent-header" },
        { "P": 10, "Name": "AWSManagedRulesCommonRuleSet" },
        { "P": 11, "Name": "AWSManagedRulesKnownBadInputsRuleSet" },
        { "P": 12, "Name": "AWSManagedRulesSQLiRuleSet" },
        { "P": 13, "Name": "AWSManagedRulesLinuxRuleSet" },
        { "P": 14, "Name": "AWSManagedRulesAdminProtectionRuleSet" }
    ]
}

aws wafv2 get-web-acl-for-resource \
  --resource-arn <ALB の ARN> \
  --query 'WebACL.Name' \
  --region ap-northeast-1

"sa-pub-app"

curl -s -o /dev/null -w '%{http_code}\n' https://pentest.lab.infra.jp/healthz

403

TOKEN=$(terraform output -raw custom_header_value)
curl -s -o /dev/null -w '%{http_code}\n' -H "X-Pentest-Token: $TOKEN" https://pentest.lab.infra.jp/healthz

200

aws elbv2 describe-target-health \
  --target-group-arn <ターゲットグループの ARN> \
  --query 'TargetHealthDescriptions[].{Target:Target.Id,State:TargetHealth.State,Reason:TargetHealth.Reason}' \
  --region ap-northeast-1

[
    {
        "Target": "<対象アプリのインスタンス ID>",
        "State": "healthy",
        "Reason": null
    }
]

aws logs start-query \
  --log-group-name aws-waf-logs-sa-pub-app \
  --start-time $(date -d '-15 minutes' +%s) \
  --end-time $(date +%s) \
  --query-string 'fields @timestamp, action, terminatingRuleId, httpRequest.uri | sort @timestamp desc | limit 10' \
  --query queryId --output text \
  --region ap-northeast-1

<クエリ ID>

aws logs get-query-results --query-id <クエリ ID> --query 'results[*][*].value' --output text --region ap-northeast-1

<時刻>  ALLOW  allow-pentest-agent-header  /healthz
<時刻>  BLOCK  Default_Action  /healthz

aws ssm send-command \
  --instance-ids <対象アプリのインスタンス ID> \
  --document-name AWS-RunShellScript \
  --parameters 'commands=["systemctl is-active vulnapp","curl -s http://localhost/healthz"]' \
  --query 'Command.CommandId' --output text \
  --region ap-northeast-1

<コマンド ID>

aws ssm get-command-invocation \
  --command-id <コマンド ID> \
  --instance-id <対象アプリのインスタンス ID> \
  --query '{Status:Status,Output:StandardOutputContent}' \
  --region ap-northeast-1

{
    "Status": "Success",
    "Output": "active\nok\n"
}

cd ~/security-agent-lab/terraform/public-method/security-agent
terraform init
cp terraform.tfvars.example terraform.tfvars

cat terraform.tfvars

account_id = "<検証アカウント ID>"
profile    = "<プロファイル名>"
create_pentest = false

terraform plan -out=tfplan

Plan: 10 to add, 0 to change, 0 to destroy.

terraform apply tfplan

Apply complete! Resources: 10 added, 0 changed, 0 destroyed.

Outputs:

agent_space_id = "as-<ID>"
application_domain = "app-<ID>.securityagent.global.app.aws"
application_id = "app-<ID>"
domain_verification_record = "_aws_securityagent-challenge.pentest.lab.infra.jp"
service_role_arn = "arn:aws:iam::<アカウント ID>:role/sa-pub-securityagent-pentest"
target_domain_id = "td-<ID>"
target_domain_verification_status = "PENDING"

dig TXT _aws_securityagent-challenge.pentest.lab.infra.jp +short

"aws-securityagent-domain-verification=<トークン>"

aws securityagent verify-target-domain --target-domain-id td-<ID> --region ap-northeast-1

{
    "targetDomainId": "td-<ID>",
    "domainName": "pentest.lab.infra.jp",
    "createdAt": "...",
    "updatedAt": "...",
    "verifiedAt": "...",
    "status": "VERIFIED",
    "verificationStatusReason": "Verification successful for domain pentest.lab.infra.jp. This domain can be used in pentests"
}

aws securityagent batch-get-target-domains --target-domain-ids td-<ID> \
  --query 'targetDomains[0].{Name:domainName,Status:verificationStatus,Method:verificationDetails.method}' \
  --region ap-northeast-1

{
    "Name": "pentest.lab.infra.jp",
    "Status": "VERIFIED",
    "Method": "DNS_TXT"
}

sed -i 's/^create_pentest = false/create_pentest = true/' terraform.tfvars
terraform plan -out=tfplan

Plan: 1 to add, 0 to change, 0 to destroy.

terraform apply tfplan

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Outputs:

agent_space_id = "as-<ID>"
application_domain = "app-<ID>.securityagent.global.app.aws"
application_id = "app-<ID>"
domain_verification_record = "_aws_securityagent-challenge.pentest.lab.infra.jp"
pentest_id = "pt-<ID>"
service_role_arn = "arn:aws:iam::<アカウント ID>:role/sa-pub-securityagent-pentest"
target_domain_id = "td-<ID>"
target_domain_verification_status = "VERIFIED"

aws securityagent update-pentest \
  --agent-space-id as-<ID> \
  --pentest-id pt-<ID> \
  --max-task-hours 20 \
  --query '{maxTaskHours:maxTaskHours}' \
  --region ap-northeast-1

null

aws securityagent batch-get-pentests \
  --agent-space-id as-<ID> \
  --pentest-ids pt-<ID> \
  --query 'pentests[0].{id:pentestId,maxTaskHours:maxTaskHours}' \
  --region ap-northeast-1

{
    "id": "pt-<ID>",
    "maxTaskHours": 20.0
}

aws securityagent list-pentest-jobs-for-pentest \
  --agent-space-id as-<ID> \
  --pentest-id pt-<ID> \
  --query 'pentestJobSummaries[].{JobId:pentestJobId,Status:status,Created:createdAt}' \
  --region ap-northeast-1

[
    {
        "JobId": "pj-<ID>",
        "Status": "IN_PROGRESS",
        "Created": "<作成時刻>"
    }
]

aws securityagent batch-get-pentest-jobs \
  --agent-space-id as-<ID> \
  --pentest-job-ids pj-<ID> \
  --query 'pentestJobs[0].{status:status,steps:steps[].join(`=`,[name,status])}' \
  --region ap-northeast-1

{
    "status": "STOPPED",
    "steps": [
        "PREFLIGHT=COMPLETED",
        "STATIC_ANALYSIS=COMPLETED",
        "PENTEST=COMPLETED",
        "FINALIZING=STOPPED"
    ]
}

aws logs start-query \
  --log-group-name aws-waf-logs-sa-pub-app \
  --start-time <実行開始の epoch 秒> \
  --end-time <実行終了の epoch 秒> \
  --query-string 'stats count(*) as requests by action, terminatingRuleId | sort requests desc' \
  --query queryId --output text \
  --region ap-northeast-1

<クエリ ID>

aws logs get-query-results --query-id <クエリ ID> \
  --query 'results[*][*].value' --output text \
  --region ap-northeast-1

ALLOW   allow-pentest-agent-header      4370
BLOCK   Default_Action  23
BLOCK   AWSManagedRulesCommonRuleSet    5

aws logs start-query \
  --log-group-name aws-waf-logs-sa-pub-app \
  --start-time <実行開始の epoch 秒> \
  --end-time <実行終了の epoch 秒> \
  --query-string 'filter action = "BLOCK" | stats count(*) as requests by httpRequest.clientIp | sort requests desc | limit 20' \
  --query queryId --output text \
  --region ap-northeast-1

cat > run1-count.json <<'JSON'
{"commands":[
 "journalctl -u vulnapp --since '<開始 UTC>' --until '<終了 UTC>' --no-pager -o cat > /tmp/run1.log",
 "grep -c '\"user_agent\": \"securityagent\"' /tmp/run1.log",
 "grep -c '\"user_agent\": \"securityagent\", \"x_pentest_token_present\": true' /tmp/run1.log"
]}
JSON
aws ssm send-command \
  --instance-ids <対象アプリのインスタンス ID> \
  --document-name AWS-RunShellScript \
  --parameters file://run1-count.json \
  --query 'Command.CommandId' --output text \
  --region ap-northeast-1

<コマンド ID>

aws ssm get-command-invocation \
  --command-id <コマンド ID> \
  --instance-id <対象アプリのインスタンス ID> \
  --query '{Status:Status,Output:StandardOutputContent}' \
  --region ap-northeast-1

{
    "Status": "Success",
    "Output": "4367\n4367\n"
}

cd ~/security-agent-lab/terraform/public-method/network-app
cat >> terraform.tfvars <<'EOF2'
waf_mode = "managed-first"
EOF2
terraform apply
cd ../security-agent
terraform apply

aws wafv2 get-web-acl --scope REGIONAL --name sa-pub-app --id <Web ACL の ID> \
  --query 'WebACL.{Default:DefaultAction,Rules:Rules[].{P:Priority,Name:Name}}' \
  --region ap-northeast-1

{
    "Default": { "Block": {} },
    "Rules": [
        { "P": 10, "Name": "AWSManagedRulesCommonRuleSet" },
        { "P": 11, "Name": "AWSManagedRulesKnownBadInputsRuleSet" },
        { "P": 12, "Name": "AWSManagedRulesSQLiRuleSet" },
        { "P": 13, "Name": "AWSManagedRulesLinuxRuleSet" },
        { "P": 14, "Name": "AWSManagedRulesAdminProtectionRuleSet" },
        { "P": 50, "Name": "allow-pentest-agent-header" }
    ]
}

cd ~/security-agent-lab/terraform/public-method/network-app
curl -s -o /dev/null -w '%{http_code}\n' https://pentest.lab.infra.jp/healthz

403

TOKEN=$(terraform output -raw custom_header_value)
curl -s -o /dev/null -w '%{http_code}\n' -H "X-Pentest-Token: $TOKEN" https://pentest.lab.infra.jp/healthz

200

cd ~/security-agent-lab/terraform/public-method/network-app
terraform destroy

Destroy complete! Resources: 60 destroyed.

cd ~/security-agent-lab/terraform/public-method/network-app
terraform apply
cd ../security-agent
terraform plan -out=tfplan

  # awscc_securityagent_pentest.vulnapp[0] will be updated in-place

Plan: 0 to add, 1 to change, 0 to destroy.

terraform apply tfplan

Apply complete! Resources: 0 added, 1 changed, 0 destroyed.

aws securityagent batch-get-pentests \
  --agent-space-id as-<ID> \
  --pentest-ids pt-<ID> \
  --query 'pentests[0].{id:pentestId,maxTaskHours:maxTaskHours}' \
  --region ap-northeast-1

{
    "id": "pt-<ID>",
    "maxTaskHours": 20.0
}

cd ~/security-agent-lab/terraform/public-method/network-app
curl -s -o /dev/null -w '%{http_code}\n' https://pentest.lab.infra.jp/healthz

403

TOKEN=$(terraform output -raw custom_header_value)
curl -s -o /dev/null -w '%{http_code}\n' -H "X-Pentest-Token: $TOKEN" https://pentest.lab.infra.jp/healthz

200

cd ~/security-agent-lab/terraform/public-method/security-agent
terraform plan -destroy -out=tfplan-destroy
terraform apply tfplan-destroy

Plan: 0 to add, 0 to change, 11 to destroy.
...
awscc_securityagent_pentest.vulnapp[0]: Destruction complete after 6s
awscc_securityagent_agent_space.lab: Destruction complete after 5s
awscc_securityagent_application.lab[0]: Destruction complete after 5s
aws_route53_record.domain_verification: Destruction complete after 32s
awscc_securityagent_target_domain.app: Destruction complete after 6s

Apply complete! Resources: 0 added, 0 changed, 11 destroyed.

aws securityagent list-integrations --region ap-northeast-1

{
    "integrationSummaries": []
}

cd ../network-app
terraform plan -destroy -out=tfplan-destroy
terraform apply tfplan-destroy

Plan: 0 to add, 0 to change, 60 to destroy.
...
Apply complete! Resources: 0 added, 0 changed, 60 destroyed.

aws route53 list-resource-record-sets --hosted-zone-id <委任ゾーンの ID> --query 'ResourceRecordSets[].Type'

[
    "NS",
    "SOA"
]

cd ../dns-zone
terraform plan -destroy -out=tfplan-destroy
terraform apply tfplan-destroy

Plan: 0 to add, 0 to change, 1 to destroy.
aws_route53_zone.lab: Destruction complete after 31s

Apply complete! Resources: 0 added, 0 changed, 1 destroyed.

dig NS infra.jp +short
dig NS lab.infra.jp @<上で返った親ゾーンの権威サーバー> +norecurse

;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 46194
;; flags: qr aa; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

aws wafv2 list-web-acls --scope REGIONAL --query 'WebACLs[].Name' --region ap-northeast-1
aws acm list-certificates --query 'CertificateSummaryList[].DomainName' --region ap-northeast-1
aws elbv2 describe-load-balancers --query 'LoadBalancers[].LoadBalancerName' --region ap-northeast-1
aws ec2 describe-vpcs --query 'Vpcs[?IsDefault==`false`].VpcId' --region ap-northeast-1
aws iam list-roles --query 'Roles[?starts_with(RoleName, `sa-pub`)].RoleName'
aws s3api list-buckets --query 'Buckets[?starts_with(Name, `sa-pub`)].Name'
aws route53 list-hosted-zones --query 'HostedZones[].Name'

[]
[]
[]
[]
[]
[]
[]

aws logs describe-log-groups --log-group-name-prefix /aws/securityagent/ --query 'logGroups[].logGroupName' --region ap-northeast-1

[
    "/aws/securityagent/sa-pub-vulnapp/cr-<ID>",
    "/aws/securityagent/sa-pub-vulnapp/pt-<ID>"
]

aws securityagent list-applications --region ap-northeast-1
aws securityagent list-agent-spaces --region ap-northeast-1
aws securityagent list-integrations --region ap-northeast-1

{
    "applicationSummaries": []
}
{
    "agentSpaceSummaries": []
}
{
    "integrationSummaries": []
}