SkyArk

SkyArk is a cloud security project with two main scanning modules: 1. AzureStealth - Scans Azure environments 2. AWStealth - Scan AWS environments These two scanning modules will discover the most privileged entities in the target AWS and Azure. The Main Goal - Discover The Most Privileged Cloud...

pentest-book

description: - This book contains a bunch of info, scripts and knowledge used during my pentests. /home/six2dez/.pentest-book Thanks to visit this site, please consider enhance this book with some awesome tools or techniques you know, you can contact me by Telegram@six2dez, Twitter@six2dez1 or...

Nebula

Nebula Nebula is a Cloud and hopefully DevOps Penetration Testing framework. It is build with modules for each provider and each functionality. As of April 2021, it only covers AWS, but is currently an ongoing project and hopefully will continue to grow to test GCP, Azure, Kubernetes, Docker, or...

cli

CloudGraph is the free open-source universal GraphQL API and Cloud Security Posture Management CSPM tool for AWS, Azure, GCP, and K8s. With CloudGraph you get: Free and effortless compliance checks i.e. Azure CIS 1.3.1, GCP CIS 1.2, AWS CIS 1.2, AWS CIS 1.3, AWS CIS 1.4, AWS PCI 3.2.1, AWS NIST...

Mindmaps

Pentesting Azure Mindmap Get the Global Admin access 💥 with this mindmap for Azure penetration tests. Feel free to pull request with your techniques ! ❤️ Developed by Alexis Danizan Released as open source by Synacktiv 🥷 📖 Resources Useful resources used to build this mindmap, many outstanding...

cloudfox

🦊 CloudFox 🦊 CloudFox helps you gain situational awareness in unfamiliar cloud environments. It’s an open source command line tool created to help penetration testers and other offensive security professionals find exploitable attack paths in cloud infrastructure. CLOUDFOX UPDATE REQUIRED: 12/202...

cloud-sniper

Cloud Sniper : Detection-as-code platform Cloud Sniper is a comprehensive platform meticulously designed to streamline Cloud Security Operations. It swiftly responds to security incidents by analyzing and correlating cloud artifacts, ensuring a holistic view of the company's cloud security postur...

Vajra

Vajra - Your Weapon To Cloud About Vajra Vajra is a UI based tool with multiple techniques for attacking and enumerating in target's Azure environment. The term Vajra refers to the Weapon of God Indra in Indian mythology God of Thunder & Storms. Its connection to the cloud makes it a perfect name...

security-study-plan

A Practical Study Plan to become a successful cybersecurity engineer based on roles like Pentest, AppSec, Cloud Security, DevSecOps, and so on with free/paid resources, tools, and concepts to excel. It will cover but not limited to: Done 1. Common Skills for Security Study Plan 2. AWS Security...

cloudgoat

CloudGoat ☁️🐐...

smogcloud

☁️ Smogcloud Find exposed AWS cloud assets that you did not know you had. A comprehensive asset inventory is step one to any capable security program. We made smogcloud to enable security engineers, penetration testers, and AWS administrators to monitor the collective changes that create dynamic...

KaiMonkey

KaiMonkey - Vulnerable Terraform Infrastructure KaiMonkey provides vulnerable infrastructure as code IaC to help explore and understand common cloud security threats exposed via IaC. Introduction KaiMonkey is an effort to provide a playground of vulnerable infrastructure as code to help analyze &...

pacu

Quick reference Where to get help : the Rhino Security Labs Discord, or Stack Overflow Where to file issues : https://github.com/RhinoSecurityLabs/pacu/issues Maintained by : Rhino Security Labs What is Pacu? Pacu is an open-source AWS exploitation framework, designed for offensive security testi...

PENTEST-LAB

PENTEST-LAB A modern vulnerable application & cyber range for learning web, API, cloud, AI, and blue-team security through hands-on attack chains. ╔═══════════════════════════════════════════════════════════════╗ ║ ██████╗ ███████╗███╗ ██╗████████╗███████╗███████╗████████╗ ║ ║ ██╔══██╗██╔════╝███...

cs-suite

Cloud Security Suite cs-suite - Version 3.0 Usage usage: cs.py -h -env aws,gcp,azure,digitalocean -aip AUDITIP -u USERNAME -pem PEMFILE -p -pId PROJECTID -azu AZUREUSER -azp AZUREPASS -o OUTPUT -w -n NUMBER this is to get IP address for lynis audit only optional arguments: -h, --help show this he...

Awesome-CloudSec-Labs

Awesome Cloud Security Labs A list of free cloud native security learning labs. Includes CTF, self-hosted workshops, guided vulnerability labs, and research labs. Sorted by Technology and Category Name| Technology| Category| Author| Notes ---|---|---|---|--- The Ultimate Cloud Security...

hammer

Overview Dow Jones Hammer is a multi-account cloud security tool for AWS. It identifies misconfigurations and insecure data exposures within most popular AWS resources, across all regions and accounts. It has near real-time reporting capabilities e.g. JIRA, Slack to provide quick feedback to...

aws-log4j-mitigations

aws-log4j-mitigations Mitigations to implement on AWS to attempt to prevent log4j exploitation. Using WAFv2 with Ansible. Inspired by: https://github.com/OllieJC/aws-log4j-mitigations...

Threat_Model_Examples

Threat Model Examples This repository contains various threat model examples for different technologies and systems. These resources provide illustrative examples of threat models across different domains, helping security professionals, developers, and researchers better understand how threat...

ZeusCloud

Secure your cloud. ZeusCloud is an open source cloud security platform. Discover, prioritize, and remediate your risks in the cloud. Build an asset inventory of your AWS accounts. Discover attack paths based on public exposure, IAM, vulnerabilities, and more. Prioritize findings with graphical...