Cloud

Tools

• cloudflair
  • Find origin servers of websites behind CloudFlare by using Internet-wide scan data from Censys
• cloud_enum
  • Multi-cloud OSINT tool
• cloud-service-enum
  • Enumerate cloud servivces that a user has access to
• stratus-red-team
  • Adversary simulation in the cloud
• CloudFox
  • Find exploitable paths in cloud infrastructure
• ScoutSuite
  • Multi-cloud auditing tool
• cloudscraper
  • Bypass CloudFlare's antibot page
• hackingthe.cloud
  • Encyclopedia of attacks/defenses for cloud services

AWS

• boto3
  • Official AWS SDK for Python
• s3scanner
  • Enumerate S3 buckets
• aws_consoler
  • Convert AWS CLI creds into AWS console access
• enumerate-iam
  • Enumerate permissions for AWS credentials
• aws_stealth_enum_perm
  • WARNING: No longer possible! This is interesting research I learned about at Black Hat 2023.
  • Blog post: Enumerate AWS API Permissions Without Logging to CloudTrail
• s3-account-search
  • Find the account ID that an S3 bucket belongs to
• lambda-persistency-poc
  • Gain persistency on a Python lambda
• aws-research-scripts
  • Various research scripts
  • As of writing, currently only enum-endpoint.py, which attempts to find endpoints for a service across all regions and environments (!)
• aws-api-model-converter
  • Convert undocumented APIs in the AWS console into use for the CLI
• enumate_iam_using_bucket_policy
  • Enumerate IAM users/roles by abusing S3 bucket policies

Azure

• AzUserEnum
  • Enumerate valid Azure AD user email IDs
• Azucar
  • Audit Azure security config
• Stormspotter
  • Azure attack surface
• ROADtools
  • Azure AD framework
• AzureHound
  • Presumably like BloodHound
• Azurite
  • Azure enum/recon
• MicroBurst
  • Azure enum + exploitation
• SkyArk
  • Discover high-privilege accounts
• PowerZure
  • PowerView for Azure

GCP

• GCPBucketBrute
  • Enumerate GCP buckets, determine what access you have + if there's potential for privilege escalation

Resources

• PayloadsAllTheThings
  • Azure Pentest
  • AWS Pentest
• Anonymously Enumerating Azure Services
• How to Identify Vulnerabilities in Public-Facing Azure Services
• Azure-Red-Team
  • Collection of tools/scripts
• NotSoSecure - cloudsecwiki
  • Quite a few resources here
• AWS CloudTrail vulnerability: Undocumented API allows CloudTrail bypass
• Bypassing CloudTrail in AWS Service Catalog, and Other Logging Research
• Azure AD Connect for Red Teamers