arte-veue

[0x1347]

Summary

Adds a new subsection to AWS - ECS Enum documenting an on-host enumeration technique that is not currently covered anywhere in the HackTricks Cloud book:
Dumping the ECS container agent's BoltDB state file at /var/lib/ecs/data/agent.db with strings command.
This is genuinely useful in real engagements because it works:

• Without any AWS API call (no CloudTrail trail, no IAM permission needed).
• Without extra tooling — strings is on every Linux box, so it works from
• As a fallback when the compromised role lacks ecs:Describe* /
• ecs:List* permissions but has host-level read access (or a container with a misconfigured /var/lib/ecs bind mount).