terragoat

TerraGoat - Vulnerable Terraform Infrastructure TerraGoat is Bridgecrew's "Vulnerable by Design" Terraform repository. TerraGoat is Bridgecrew's "Vulnerable by Design" Terraform repository. TerraGoat is a learning and training project that demonstrates how common configuration errors can find the...

cloudmapper

CloudMapper Note the Network Visualization functionality command prepare is no longer maintained. CloudMapper helps you analyze your Amazon Web Services AWS environments. The original purpose was to generate network diagrams and display them in your browser functionality no longer maintained. It...

prowler

Prowler is the Open Cloud Security Platform trusted by thousands to automate security and compliance in any cloud environment. With thousands of ready-to-use checks and compliance frameworks, Prowler delivers real-time, customizable monitoring and seamless integrations, making cloud security...

shimit

shimit shimit is a python tool that implements the Golden SAML attack. More informations on this can be found in the following article on our blog. python .\shimit.py -h usage: shimit.py -h -pk KEY -c CERT -sp SP -idp IDP -u USER -reg REGION --SessionValidity SESSIONVALIDITY --SamlValidity...

sss3

SSS3 간단한 스토리지 스캐너 SSS3는 간단한 S3 버킷 테스트 소프트웨어입니다. aws cli를 사용하여 도메인/서브도메인 목록에서 공개 버킷을 검색합니다. 기본 요구사항 aws cli가 설치되어 있고 s3 정책이 정의된 상태로 구성되어 있어야 합니다. 이전에 열거된 도메인/서브도메인 목록이 있어야 합니다. 기능 도메인/서브도메인 목록을 반복적으로 처리합니다. 도메인/서브도메인이 버킷에 응답하는지, 그리고 나열listing 권한이 활성화되어 있는지 테스트합니다. 발견된 버킷의 나열 결과를 내보냅니다. 설치 리포지토리를...

meltdown-aws-scanner

meltdown-aws-scanner EC2インスタンスのMeltdown（CVE-2017-5754）パッチ適用状況を確認するためのシンプルなシェルスクリプト 必要条件 動作設定済みのaws cli スクリプトの使い方 デフォルトアカウントとリージョンの全EC2インスタンスをスキャン $ ./checkmeltdown.sh | tee $date '+%Y-%m-%d'.csv デフォルトアカウントとリージョンの一部EC2インスタンスをスキャン $ ./checkmeltdown.sh --filters "Name=tag:Name,Values=prod-"...

s3sec

s3sec Test AWS S3 buckets for read/write/delete access This tool was developed to quickly test a list of s3 buckets for public read, write and delete access for the purposes of penetration testing on bug bounty programs. Screenshot Found a bug bounty using this tool? Feel free to add me as a...

metasploitable3

Metasploitable3 Metasploitable3 is a VM that is built from the ground up with a large amount of security vulnerabilities. It is intended to be used as a target for testing exploits with metasploit. Metasploitable3 is released under a BSD-style license. See COPYING for more details. Quick-start To...

sadcloud

Sadcloud sadcloud is a tool for spinning up insecure AWS infrastructure with Terraform. It supports approx. 84 misconfigurations across 22 AWS Services. The inital set of misconfigurations were drawn from ScoutSuite, NCCGroup's Multi-cloud auditing tool. sadcloud was created to easily allow...

CVE-2025-49844-discovery

ElastiCache Redis/Valkey ネットワーク分析ツール AWS ElastiCache Redis および Valkey クラスターのネットワーク露出を監査するためのスクリプトです。 前提条件 適切な認証情報で設定された AWS CLI jq がインストールされていること: brew install jq スクリプト list-elasticache-clusters.sh 指定されたリージョンにわたるすべての Redis/Valkey クラスターを一覧表示します。 ./list-elasticache-clusters.sh...

Amazon Linux 2023 : awscli-2 (ALAS2023-2026-3133)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3133 advisory. Overly permissive file permissions in AWS CLI before 1.44.78 v1 and 2.34.29 v2 on Unix-like systems where the umask has not been configured to restrict file permissions the default on most...

CLEANSTART-2026-UT95390 Security fix for CVE-2026-41080 applied in: aws-cli 2.35.9-r2, ingress-nginx-controller 1.14.5-r2

CVE-2026-41080 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CVE-2026-18654

A flaw was found in AWS CLI. This vulnerability, located in the Elastic MapReduce EMR Secure Shell SSH helper commands, involves a lack of entity authentication during key exchange. A remote attacker, positioned between the client and the EMR cluster, could exploit this to intercept SSH sessions...

Linux Distros Unpatched Vulnerability : CVE-2026-18654

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow...

PYSEC-2026-3548 AWS CLI: Overly permissive File Permissions

Summary The AWS Command Line Interface AWS CLI is a unified tool for managing AWS services from the command line. Certain CLI subcommands wrote credential and configuration files with world-readable permissions on Unix-like systems with a default umask, allowing other local users on the same host...

CVE-2026-18654 Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint. To...

CVE-2026-18654

This CVE (CVE-2026-18654) affects the EMR SSH helper commands in the Amazon AWS CLI. The issue is “Key exchange without entity authentication,” enabling potential MITM attackers to intercept SSH sessions and file transfers when connecting to an EMR cluster endpoint. Affected products are AWS CLI ...

CVE-2026-18654: Key Exchange without Entity Authentication

Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint. To...

CLEANSTART-2026-MD27911 Security fixes in aws-cli 2.35.9-r1

Package aws-cli version 2.35.9-r1 fixes 2 vulnerabilities: CVE-2026-45186, CVE-2026-41080...

CLEANSTART-2026-ZL11893 Security fixes for CVE-2026-41080, CVE-2026-45186 applied in versions: 2.35.9-r1, 2.35.9-r2

Multiple security vulnerabilities affect the aws-cli package. These issues are resolved in later releases. See references for individual vulnerability details...