Skip to content

Add article: bypass GuardDuty pentest findings via botocore user-agent#503

Open
raajheshkannaa wants to merge 1 commit intoHacking-the-Cloud:mainfrom
raajheshkannaa:feat/guardduty-useragent-bypass
Open

Add article: bypass GuardDuty pentest findings via botocore user-agent#503
raajheshkannaa wants to merge 1 commit intoHacking-the-Cloud:mainfrom
raajheshkannaa:feat/guardduty-useragent-bypass

Conversation

@raajheshkannaa
Copy link
Copy Markdown
Contributor

Closes #453

Summary

  • New article covering how GuardDuty detects pentest distros via user-agent strings in CloudTrail
  • Technique: patching boto3 session user_agent fields to strip OS identifiers
  • Working Python code example
  • Limitations section: SDK only, relies on botocore internals, user-agent is one of many signals
  • Detection guidance for defenders: baseline user-agent patterns, treat field as attacker-controlled
  • mkdocs build passes cleanly

Test plan

  • Article renders correctly with mkdocs
  • Code examples are syntactically valid Python
  • Limitations and detection sections provide balanced coverage

Covers overriding the botocore user-agent string in boto3 to avoid
triggering GuardDuty PenTest findings (Kali, Parrot, Pentoo) without
needing an intercepting proxy. Includes code example, limitations,
and detection guidance for defenders.

Closes Hacking-the-Cloud#453
@raajheshkannaa raajheshkannaa force-pushed the feat/guardduty-useragent-bypass branch from 7d66fbc to 3c9c865 Compare March 24, 2026 20:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bypass GuardDuty Pentest Findings for the AWS CLI - Botocore method.

1 participant