S3Scanner

S3Scanner Features - Usage - Quick Start - Installation - Discuss A tool to find open S3 buckets in AWS or other cloud providers: AWS DigitalOcean DreamHost GCP Linode Scaleway Custom Features ⚡️ Multi-threaded scanning 🔭 Supports many built-in S3 storage providers or custom 🕵️‍♀️ Scans all...

Onionscan

onionscan deployment note! this repo is a patched version of https://github.com/s-rah/onionscan and is designed to be run from a google cloud shell from hunchly at https://github.com/hunchly/funchly/tree/main/onionscan which has been used as the baseline and modified to also be able to deploy on ...

aura-inspector

aura-inspector This is not an officially supported Google product. This project is not eligible for the Google Open Source Software Vulnerability Rewards Program. Introduction aura-inspector is a Swiss Army knife of Salesforce Experience Cloud testing. It facilitates in discovering misconfigured...

PurplePanda

PurplePanda This tool fetches resources from different cloud/saas applications focusing on permissions in order to identify privilege escalation paths and dangerous permissions in the cloud/saas configurations. Note that PurplePanda searches both privileges escalation paths within a platform and...

cloud_enum

cloudenum cloudenum 的未来 我在2019年构建了这个工具，用于一次涉及Azure的渗透测试，因为当时没有其他枚举工具支持它。它从那里发展起来，在添加功能的过程中我学到了很多。 构建工具很有趣，但维护工具很难。我有一段时间没有积极使用这个工具了，但我已尽力修复错误和审查拉取请求。 向前看，将这些功能整合到一个维护良好、处理基本事项（Web/DNS请求、线程、I/O、日志等）的项目中是合理的。Nuclei 非常适合这个目的。你可以看到我第一个将 cloudenum 功能迁移到 Nuclei 的拉取请求此处。 我鼓励其他人向 Nuclei...

cloud_enum

cloudenum Future of cloudenum I built this tool in 2019 for a pentest involving Azure, as no other enumeration tools supported it at the time. It grew from there, and I learned a lot while adding features. Building tools is fun, but maintaining tools is hard. I haven't actively used this tool...

purple-team-exercise-framework

Purple Team Exercise Framework PTEF The Purple Team Exercise Framework PTEF is the industry standard methodology for designing and executing collaborative security exercises that bring together Cyber Threat Intelligence CTI, Red Teams, and Blue Teams. Purple Team Exercises are an efficient method...

CodeAnalysis

TCA, Tencent Cloud Code Analysis code-named: CodeDog English | 简体中文 TCA Official Official website: https://tca.tencent.com Official introduction: https://cloud.tencent.com/product/tcap TCA CNB PagesBetter Internet Speed Domestic: https://cnb.cool/tencent/cloud/tca/code-analysis Domestic:...

SpringExploitGUI

SpringExploitGUIv1.0 0x01 Preface Today, I reproduced several previous Spring vulnerabilities and weaponized them. The tool currently supports detection and exploitation of Spring Cloud Gateway RCE CVE-2022-22947, Spring Cloud Function SpEL RCE CVE-2022-22963, and Spring Framework RCE...

coalmine

Cloud Canary Token Management — Deploy, monitor, and rotate deceptive credentials across AWS and GCP to detect unauthorized access. !WARNING Alpha Version — Coalmine is in early development. Basic functionality is the current priority, and the application should not be considered fully security...

metarget

中文 | English 1 Introduction Metarget = meta- + target, a framework providing automatic constructions of vulnerable infrastructures, used to deploy simple or complicated vulnerable cloud native targets swiftly and automatically. 1.1 Why Metarget? During security researches, we might find that the...

CVE-2026-50338

CVE-2026-50338 Spring Cloud Azure B2C Resource Server Cross-Issuer Authentication Bypass Description AadB2cResourceServerAutoConfiguration in spring-cloud-azure-autoconfigure builds a JwtDecoder that trusts six AAD-line issuers login.microsoftonline.com, sts.windows.net, sts.chinacloudapi.cn, v1...

AzureHunter

A Powershell module to run threat hunting playbooks on data from Azure and O365 for Cloud Forensics purposes. Getting Started 1. Check that you have the right O365 Permissions...

CVE-2026-2472-Vertex-AI-SDK-Google-Cloud

🚨 CVE-2026-2472-Vertex-AI-SDK-Google-Cloud - Simple Proof of Concept Tool 🛠 About This Application This tool shows a technical proof of concept PoC for the security issue CVE-2026-2472. The issue affects the Vertex AI Python SDK from Google Cloud Platform. It relates to an unauthenticated and...

whoc

whoc A container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform! WhoC at Defcon 29 Cloud Village Azurescape - whoc-powered research, the first cross-account container takeover i...

Awesome-CloudSec-Labs

Awesome Cloud Security Labs A list of free cloud native security learning labs. Includes CTF, self-hosted workshops, guided vulnerability labs, and research labs. Sorted by Technology and Category Name| Technology| Category| Author| Notes ---|---|---|---|--- The Ultimate Cloud Security...

metlo

Metlo API Security Secure Your API. Metlo is an open-source API security platform Metlo is an open source API security tool you can setup in 15 minutes that inventories your endpoints, detects bad actors and blocks malicious traffic in real time. Detect API attacks in real time. Automatically blo...

hermes-agent

Hermes Agent ☤ Hermes Agent | Hermes Desktop...

restler-fuzzer

RESTler What is RESTler? RESTler is the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services. For a given cloud service with an OpenAPI formerly Swagger specification, RESTler analyzes its...

restler-fuzzer

RESTler 什么是 RESTler？ RESTler 是 首个有状态的 REST API 模糊测试工具 ，用于通过 REST API 自动测试云服务，并发现这些服务中的安全性和可靠性错误。对于具有 OpenAPI（原名 Swagger）规范的云服务，RESTler 分析其完整规范，然后生成并执行通过 REST API 对服务进行测试的测试用例。 RESTler 智能地从 OpenAPI 定义中推断出请求类型之间的生产者-消费者依赖关系。在测试过程中，它会检查特定类别的错误，并根据先前的服务响应动态学习服务的行为方式。这种智能使 RESTler...