awsEnum

awsEnum Enumrate AWS services! with no nosies awsEnum is a python script enumrate AWS services through the provided credential. :book: Table of Contents Table of Contents 1. Screenshot 2. Disclaimer 3. Features 4. Prerequisites 5. How to Install 6. Results and FQAs 7. To-Do :clapper: Screenshot...

phishlulz

PhishLulz PhishLulz is a Ruby toolset aimed at automating Phishing activities. When you start a phishing campaign, a dedicated Amazon EC2 Debian 7 instance is spawned. The VM comes with various open source tools that have been glued together. The two main components are: PhishingFrenzy...

cloudquery

CloudOps, without the chaos CloudQuery is a cloud asset inventory built for platform teams. Sync your cloud infrastructure metadata into your data warehouse, powering insights and automation. Unify data and provide context across AWS, Azure, GCP, and 70+ cloud and SaaS sources such as Wiz, Finout...

serverless-prey

Puma Security Serverless Prey Serverless Prey is a collection of serverless functions FaaS, that, once launched to a cloud environment and invoked, establish a TCP reverse shell, enabling the user to introspect the underlying container: Panther: AWS Lambda written in Node.js Cougar: Azure Functio...

serverless-prey

Puma Security Serverless Prey Serverless Prey es una colección de funciones serverless FaaS que, una vez lanzadas a un entorno en la nube e invocadas, establecen un TCP reverse shell, permitiendo al usuario inspeccionar el contenedor subyacente: Panther: AWS Lambda escrito en Node.js Cougar:...

yatas

YATAS Yet Another Testing & Auditing Solution The goal of YATAS is to help you create a secure AWS environment without too much hassle. It won't check for all best practices but only for the ones that are important for you based on my experience. Please feel free to tell me if you find something...

s3-leaks

s3-leaks List of AWS S3 Leaks Feel free to send in a PR if you know of other leaks...

CredKing

CredKing Overview Benefits Basic Usage Plugin Usage Gmail Okta Installation Development Plugin specific arguments Overview Easily launch a password spray using AWS Lambda across multiple regions, rotating IP addresses with each request. Brought to you by: Benefits Fully supports all AWS Lambda...

EUVD-2026-80070

A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. Affected is the function urllib.request.urlopen of the file integrations/aws-strands/python/src/aguistrands/utils.py of the component Multimodal Content. The manipulation of the argument Value results in server-side request forger...

cloudfoxable

Start Hacking: CloudFoxable Read the blog for more details: Introducing CloudFoxable: A Gamified Cloud Hacking Sandbox Background CloudFox helps penetration testers and security professionals find exploitable attack paths in cloud infrastructure. However, what if you want to find and exploit...

binaryalert

BinaryAlert: Serverless, Real-Time & Retroactive Malware Detection .. image:: https://travis-ci.org/airbnb/binaryalert.svg?branch=master :target: https://travis-ci.org/airbnb/binaryalert :alt: Build Status .. image:: https://coveralls.io/repos/github/airbnb/binaryalert/badge.svg?branch=master...

cs-suite

Cloud Security Suite cs-suite - Version 3.0 Usage root@kitploit: usage: cs.py -h -env aws,gcp,azure,digitalocean -aip AUDITIP -u USERNAME -pem PEMFILE -p -pId PROJECTID -azu AZUREUSER -azp AZUREPASS -o OUTPUT -w -n NUMBER this is to get IP address for lynis audit only optional arguments: -h, --he...

cloudsplaining

Cloudsplaining Cloudsplaining es una herramienta de evaluación de seguridad de AWS IAM que identifica violaciones del principio de mínimo privilegio y genera un informe HTML priorizado por riesgo. ' custom-guidance.html ' custom-appendices.html Generar informe con contenido personalizado...

cloudsplaining

Cloudsplaining Cloudsplaining is an AWS IAM Security Assessment tool that identifies violations of least privilege and generates a risk-prioritized HTML report. Example report...

CVE-2026-92184

A server-side request forgery (SSRF) vulnerability exists in ag-ui-protocol ag-ui 0.3.0 , affecting the function urllib.request.urlopen in the file integrations/aws-strands/python/src/ag_ui_strands/utils.py within the Multimodal Content component. Manipulation of the argument Value enables the fl...

BucketLoot

BucketLoot An Automated S3-compatible Bucket Inspector Description • Installation • Features • Documentation • Acknowledgements Description BucketLoot is an automated S3-compatible Bucket inspector that can help users extract assets, flag secret exposures and even search for custom keywords as we...

cloud_enum

cloudenum Futuro de cloudenum Construí esta herramienta en 2019 para una prueba de penetración que involucraba Azure, ya que en ese momento ninguna otra herramienta de enumeración lo soportaba. Creció a partir de ahí y aprendí mucho mientras añadía funcionalidades. Construir herramientas es...

cloud_enum

cloudenum Future of cloudenum I built this tool in 2019 for a pentest involving Azure, as no other enumeration tools supported it at the time. It grew from there, and I learned a lot while adding features. Building tools is fun, but maintaining tools is hard. I haven't actively used this tool...

barq

barq barq: The AWS Cloud Post Exploitation framework! What is it? barq is a post-exploitation framework that allows you to easily perform attacks on a running AWS infrastructure. It allows you to attack running EC2 instances without having the original instance SSH keypairs. It also allows you to...

s3-account-search

S3 Account Search This tool lets you find the account id an S3 bucket belongs too. For this to work you need to have at least one of these permissions: Permission to download a known file from the bucket s3:getObject. Permission to list the contents of the bucket s3:ListBucket. Additionally, you...