pytm

pytm: A Pythonic framework for threat modeling Introduction Traditional threat modeling too often comes late to the party, or sometimes not at all. In addition, creating manual data flows and reports can be extremely time-consuming. The goal of pytm is to shift threat modeling to the left, making...

CredKing

CredKing Overview Benefits Basic Usage Plugin Usage Gmail Okta Installation Development Plugin specific arguments Overview Easily launch a password spray using AWS Lambda across multiple regions, rotating IP addresses with each request. Brought to you by: Benefits Fully supports all AWS Lambda...

DIAL

DIAL Workloads on cloud provide equal opportunities for hackers as much as they do for internal teams. Cloud-native companies are open to attacks from both outside forces and from within. With ever growing risk of a security breach and cloud misconfiguration being one of the most common factor of...

nuclearpond

Nuclear Pond Nuclear Pond is used to leverage Nuclei in the cloud with unremarkable speed, flexibility, and perform internet wide scans for far less than a cup of coffee. It leverages AWS Lambda as a backend to invoke Nuclei scans in parallel, choice of storing json findings in s3 to query with A...

adaptix-serverless-c2

Adaptix Serverless C2 Serverless C2 transport plugin for AdaptixC2 v1.2 using AWS Lambda + DynamoDB as the relay infrastructure. Agent traffic appears as outbound HTTPS to AWS endpoints, requiring no inbound ports or public IPs on the C2 server. Architecture Kharon Agent target | | HTTPS GET/POST...

honeyLambda

Serverless trap honeyλ - a simple serverless application designed to create and monitor URL honeytokens, on top of AWS Lambda and Amazon API Gateway Slack notifications Email and SMS alerts Load config from local file or Amazon S3 Customize the HTTP response for each token Threat Intelligence...

Serverless-Goat

Introduction Thank you for using OWASP ServerlessGoat! ​ This serverless application demonstrates common serverless security flaws as described in the Serverless Security Top 10 Weaknesses guide https://github.com/puresec/sas-top-10. ​ ServerlessGoat was created for the following educational...

serverless

Website • Documentation • X / Twitter • Community Slack • Forum The Serverless Framework – Makes it easy to use AWS Lambda and other managed cloud services to build applications that auto-scale, cost nothing when idle, and result in radically low maintenance. The Serverless Framework is a...

CVE-2026-22008-AWS-Lambda-Layer-Injection-via-Shared-Layer-ARN

CVE-2026-22008 – AWS Lambda Layer Injection via Shared Layer ARN Program Code Python deployvulnerablelambda.py - Lambda function using a layer from untrusted account import boto3 lambdaclient = boto3.client'lambda' Attacker publishes a public layer containing malicious code Victim function...

CVE-2026-21002-Serverless-Cold-Start-Credential-Leakage-via-Reused-tmp

CVE-2026-21002 – Serverless Cold Start Credential Leakage via Reused /tmp Program Code Python AWS Lambda sim lambdafuncsim.py - Simulated serverless function import os, tempfile, time SECRETFILE = '/tmp/credentials' reused across warm starts def handlerevent: On first invocation, write a secret i...

DVFaaS-Damn-Vulnerable-Functions-as-a-Service

DVFaaS - Damn Vulnerable Functions as a Service A DHIY Deploy and Hack It Yourself Project that you can deploy and run a bunch of 'orribly insecure functions on AWS Lambda Objective and Audiences We at we45 do a lot of training around Serverless Security, Cloud and security of modern web stacks. ...

nuclearpond-OFJAAAH

Nuclear Pond V.2 We forked this project so we can continue with this great idea, I hope that together we can improve the code and make it available to everyone - @OFJAAAH To install Nuclear Pond, you need to configure the backend terraform module. You can do this by running terraform apply or by...

LambdaGuard

LambdaGuard AWS Lambda is an event-driven, serverless computing platform provided by Amazon Web Services. It is a computing service that runs code in response to events and automatically manages the computing resources required by that code. LambdaGuard is an AWS Lambda auditing tool designed to...

GO-2026-6789 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-sns, crossplane-provider-aws-sqs, kubevela, crossplane-provider-aws-ec2, crossplane-provider-keycloak, crossplane-provider-aws-iam, crossplane-provider-aws-lambda, crossplane-provider-aws-kinesis, crossplane-provider-aws-s3, grafana,...

GO-2026-6795 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-sns, crossplane-provider-aws-sqs, kubevela, crossplane-provider-aws-ec2, crossplane-provider-keycloak, crossplane-provider-aws-iam, crossplane-provider-aws-lambda, crossplane-provider-aws-kinesis, crossplane-provider-aws-s3, grafana,...

GO-2026-6769 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-sns, crossplane-provider-aws-sqs, kubevela, crossplane-provider-aws-ec2, crossplane-provider-keycloak, crossplane-provider-aws-iam, crossplane-provider-aws-lambda, crossplane-provider-aws-kinesis, crossplane-provider-aws-s3, grafana,...

GO-2026-6783 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-sns, crossplane-provider-aws-sqs, kubevela, crossplane-provider-aws-ec2, crossplane-provider-keycloak, crossplane-provider-aws-iam, crossplane-provider-aws-lambda, crossplane-provider-aws-kinesis, crossplane-provider-aws-s3, grafana,...

GO-2026-6785 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-sns, crossplane-provider-aws-sqs, kubevela, crossplane-provider-aws-ec2, crossplane-provider-keycloak, crossplane-provider-aws-iam, crossplane-provider-aws-lambda, crossplane-provider-aws-kinesis, crossplane-provider-aws-s3, grafana,...

GO-2026-6800 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-sns, crossplane-provider-aws-sqs, kubevela, crossplane-provider-aws-ec2, crossplane-provider-keycloak, crossplane-provider-aws-iam, crossplane-provider-aws-lambda, crossplane-provider-aws-kinesis, crossplane-provider-aws-s3, grafana,...

aws-key-disabler

AWS Lambda - Desactivador de Claves de Acceso IAM El desactivador de claves de AWS es una función Lambda que desactiva las claves de acceso de usuarios IAM de AWS después de un tiempo determinado para reducir el riesgo asociado a claves de acceso antiguas. Arquitectura de AWS Lambda Salida de...