Nick Frichette

Staff Engineer and Security Researcher

This server is part of the Tor network. Onion Address: nickf43ab43xxf3yqgzy5uedsjij6h473rmbyzq6inohcnr3lohlu3yd.onion

Background

My name is Nick Frichette and I'm a Staff Security Researcher, primarily focused on cloud, web application, and CI/CD exploitation. Previously, I worked as a Penetration Tester and Team Lead for a large financial services company.

In my free time I perform security research, participate in CTFs, and engage in community forums. In addition, I'm the primary maintainer of Hacking the Cloud, an encyclopedia of the techniques that offensive security professionals can use against cloud environments.

Aside from that, I'm fortunate to be a part of the AWS Community Builders Program.

Vulnerability Research

These are some notable results from my research. More can be found at my blog.

• Enumerating AWS the quiet way: CloudTrail-free discovery with Resource Explorer
• Non-Production Endpoints as an Attack Surface in AWS
• Amplified exposure: How AWS flaws made Amplify IAM roles vulnerable to takeover
• Bypassing CloudTrail in AWS Service Catalog, and Other Logging Research
• Cross-Tenant Confused Deputy Vulnerability in AWS AppSync
• AWS CloudTrail bypass for specific IAM actions
• XSS in the AWS Console
• Enumerate AWS API Permissions without Logging to CloudTrail
• Intercept SSM Agent Communications
• CVE-2020-11108: How I stumbled into a Pi-Hole RCE+LPE
• CVE-2020-15511: Account Takeover in Terraform Enterprise

Community Involvement

I'm involved/participate with the security community in several ways. Here are just a few:

• fwd:cloudsec 2025 EU - "Sweet Deception: Mastering AWS Honey Tokens to Detect and Outsmart Attackers", shared my research on detecting and avoiding AWS access key honey tokens as well as pointed out flaws in well known implementations.
• RSAC 2025 - "Critiquing Cloud Criminals: Ready for Smarter Cloud Attacks?", covering common OPSEC failures threat actors make when attacking cloud environments, how you can catch them, and how you can achieve the same thing stealthily.
• Wild West Hackin' Fest: Mile High 2025 - I was the opening keynote speaker for the conference with "I Want You to Hack AWS: Cloud Penetration Testing for Traditional Hackers".
• fwd:cloudsec EU 2024 - "Hidden Among the Clouds: A Look at Undocumented AWS APIs", a talk where I shared my research on finding thousands on undocumented AWS APIs.
• DEF CON 32 Cloud Village - "Kicking in the Door to the Cloud: Exploiting Cloud Provider Vulnerabilities for Initial Access".
• DEF CON 32 - I spoke on the main stage of DEF CON 32, sharing my research on exploiting AWS service vulnerabilities for initial access. The talk was titled "Kicking in the Door to the Cloud: Exploiting Cloud Provider Vulnerabilities for Initial Access".
• Black Hat USA 2024 - I presented on the main stage with "Kicking in the Door to the Cloud: Exploiting Cloud Provider Vulnerabilities for Initial Access", a look at vulnerabilities I've found in AWS services which would allow an attacker to gain initial access to a victim environment.
• fwd:cloudsec NA 2024 - I gave a talk titled "Trust Me Bro: Preexisting Trust is the New Initial Access Vector" at fwd:cloudsec NA 2024.
• Black Hat USA 2023 - I spoke on the main stage of Black Hat USA 2023 about my research into CloudTrail evasion.
• Cloud Security Podcast: How to Escape Clusters in a Managed Kubernetes Cluster? - I was a guest on the Cloud Security Podcast talking about abusing managed Kubernetes clusters.
• DEF CON Cloud Village 2023 - I gave a talk at the DEF CON Cloud Village titled "Evading Logging in the Cloud: Bypassing AWS CloudTrail".
• Wiz: Top 16 cloud security experts you should follow in 2023 - I was included as a "top cloud security expert" in Wiz's yearly roundup.
• fwd:cloudsec 2023 - Gave a talk titled "Evading Logging in the Cloud: Disrupting and Bypassing AWS CloudTrail", which was an overview of my research on AWS CloudTrail bypasses.
• Cloud Security Podcast: Getting Started with Hacking AWS Cloud - I was a guest on the Cloud Security Podcast, discussing some of my security research.
• SANS Pentest Hackfest 2022 - Gave a talk at the main track on "What I Wish I Knew Before Pentesting AWS Environments" (slides)
• Screaming in the Cloud #226 - Corey Quinn - I was a guest on the Screaming in the Cloud podcast, hosted by Corey Quinn. We talked about offensive security in AWS, AWS security research, and more.
• Research in the News - My research has been featured in multiple well-known newsletters including CloudSecList, tl;dr sec, and Bug Bytes.
• ShellCon 2020 - Gave a talk (Hacking AWS - TTPs for the Cloud) at the Main Track of ShellCon 2020. Covered the tactics and techniques a penetration testing or red team can leverage when attacking AWS infrastructure.

Education and Certifications