CVE-2026-115414 OS command injection in the Terraform hook in AWS SAM CLI

OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influence the Terraform configuration or plan file consumed by a build to execute arbitrary commands as the build user on the host running the build via a crafted Terraform resource address. To...

EUVD-2026-108281

OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influence the Terraform configuration or plan file consumed by a build to execute arbitrary commands as the build user on the host running the build via a crafted Terraform resource address. To...

cloudsploit

CloudSploit by Aqua - Cloud Security Scans Quick Start Generic $ git clone https://github.com/aquasecurity/cloudsploit.git $ cd cloudsploit $ npm install $ ./index.js -h Docker $ git clone https://github.com/aquasecurity/cloudsploit.git $ cd cloudsploit $ docker build . -t cloudsploit:0.0.1 $...

LabS4U2Self

Lab S4U2Self Abuse This lab aims to provide a safe environment to test the S4U2Self abuse exploit Deploy The project will deploy : 1 DC with a single domain admin hpotter 1 MSSQL with a weak sa password The deployment is performed through terraform and ansible on AWS thus, both these software mus...

terraform-aws-security-group

terraform-aws-security-group Terraform module to manage AWS Security Groups. Currently, the ingress and egress rules support IPv4, IPv6, and Security Group ID inputs. Requirements Name| Version ---|--- terraform| = 1.6 aws| = 5.0 Providers Name| Version ---|--- aws| = 5.0 Modules No modules...

checkov

Checkov is a static code analysis tool for infrastructure as code IaC and also a software composition analysis SCA tool for images and open source packages. It scans cloud infrastructure provisioned using Terraform, Terraform plan, Cloudformation, AWS SAM, Kubernetes, Helm charts, Kustomize,...

htb-facts

HTB — Facts Easy/Linux - Season 10 Summary Facts is an Easy Linux machine that requires exploiting a known vulnerability CVE-2025-2304 in Camaleon CMS to extract local AWS S3 credentials. Enumerating the internal S3 buckets reveals an SSH private key that must be cracked using John the Ripper to...

SkyArk

SkyArk is a cloud security project with two main scanning modules: 1. AzureStealth - Scans Azure environments 2. AWStealth - Scan AWS environments These two scanning modules will discover the most privileged entities in the target AWS and Azure. The Main Goal - Discover The Most Privileged Cloud...

c2-cloud

About The Project The C2 Cloud is a robust web-based C2 framework, designed to simplify the life of penetration testers. It allows easy access to compromised backdoors, just like accessing an EC2 instance in the AWS cloud. It can manage several simultaneous backdoor sessions with a user-friendly...

cred_scanner

credscanner A simple command line tool for finding AWS credentials in files. Optimized for use with Jenkins and other CI systems. I suspect there are other, better tools out there such as git-secrets, but I couldn't find anything to run a quick and dirty scan that also integrates well with Jenkin...

binaryalert

BinaryAlert: Serverless, Real-Time & Retroactive Malware Detection .. image:: https://travis-ci.org/airbnb/binaryalert.svg?branch=master :target: https://travis-ci.org/airbnb/binaryalert :alt: Build Status .. image:: https://coveralls.io/repos/github/airbnb/binaryalert/badge.svg?branch=master...

CVE-2026-115416

Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results, and data stored in Amazon S3 or other data sources, were not...

cloud_enum

cloudenum Future of cloudenum I built this tool in 2019 for a pentest involving Azure, as no other enumeration tools supported it at the time. It grew from there, and I learned a lot while adding features. Building tools is fun, but maintaining tools is hard. I haven't actively used this tool...

prowler

Prowler is the Open Cloud Security Platform trusted by thousands to automate security and compliance in any cloud environment. With thousands of ready-to-use checks and compliance frameworks, Prowler delivers real-time, customizable monitoring and seamless integrations, making cloud security...

log4shell-cloud-scanner

.. image:: images/Mitigalogo.png Introduction we are providing DevOps and security teams script to identify cloud workloads that may be vulnerable to the Log4j vulnerabilitylog4shell in their AWS account. We currently support "CVE-2021-44228" and "CVE-2021-45046" RCE vulnerabilities. The script...

cloudfox

🦊 CloudFox 🦊 CloudFox helps you gain situational awareness in unfamiliar cloud environments. It’s an open source command line tool created to help penetration testers and other offensive security professionals find exploitable attack paths in cloud infrastructure. CLOUDFOX UPDATE REQUIRED: 12/202...

EUVD-2026-108258

Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results, and data stored in Amazon S3 or other data sources, were not...

CVE-2026-115416

Amazon Athena engine version 3 contained incorrect authorization checks during query processing. This vulnerability could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Notably, query results and data stored in Ama...

Aaia

NOTE This repository is not under active development. However, I am open to accepting PRs. Aaia still works as there has been no significant changes in terms of AWS APIs it uses to collect data. Aaia Analysis of Identity and Access Note: Expansion created post the name was decided :P What does Aa...

cloudformation-waf-acl

cloudformation-waf-acl An AWS CloudFormation template used to provision and manage AWS WAFv2 resources, including a Web ACL, managed rule groups, a custom regex pattern set, and an IP set. Components The template provisions: 1. An AWS::WAFv2::WebACL. 2. AWS managed protection rule groups:...