cloudgoat
juice-shop
| cloudgoat | juice-shop | |
|---|---|---|
| 10 | 1 | |
| 2,752 | 9,040 | |
| 12.6% | - | |
| 6.7 | 9.9 | |
| 5 days ago | 4 months ago | |
| Python | TypeScript | |
| BSD 3-clause "New" or "Revised" License | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
cloudgoat
-
CloudGoat
You can check out the documentation of the scenarios, they list the created AWS resources. The ones I checked looked either free or cheap to me. No guarantee of course and usage can also generate cost.
https://github.com/RhinoSecurityLabs/cloudgoat/blob/master/scenarios/vulnerable_lambda/README.md -
Launch HN: Corgea (YC S23) – Auto fix vulnerable code
https://github.com/RhinoSecurityLabs/cloudgoat/blob/8ed1cf0e...
Is there something I'm missing?
-
The TISC 2022 Writeup
I tried viewing the other lambda function first, since it's a privilege with the lambda_agent role. I referred to here to help with the code.
- Cloud Pentesting Learning Resources
-
Has anyone took the AWS Pentesting Bootcamp on Pentester Academy?
https://github.com/RhinoSecurityLabs/cloudgoat Good alternative for low cost
-
Hide Your Keys Hide Your Data
Settle your horses. In this post, we will be using CloudGoat. CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool. It allows you to hone your cloud cybersecurity skills by creating and completing several "capture-the-flag" style scenarios. CloudGoat.
-
Pen testing advice
Tryhackme and hackthebox are nice (vulnhub as well), also good to spin up some VMs to test stuff/techniques on. Learn some programming as well. If you're doing cloud testing, Cloudgoat is pretty good (you'll need an aws account first). If web testing, Burpsuite is very helpful. If doing intranet testing, try familiarizing yourself with SysInternals, maybe also Bloodhound, Nmap, etc. Tbh pentesting is a big field in and of itself. Might sometimes feel a bit overwhelming.
- Practice Cloud Security
juice-shop
-
Launch HN: Corgea (YC S23) – Auto fix vulnerable code
Thank you! Please give it a spin. We'd love any feedback or thoughts. :)
We are using it on our codebases, and it's helped us secure our own product. Users have also been trying it out with their private codebases, and we even used our own personal projects to test it.
If you'd like to try Corgea with some open-source tools, there are a ton of applications that are vulnerable by design like. Some popular ones:
https://github.com/bkimminich/juice-shop
What are some alternatives?
awesome-aws-security - Curated list of links, references, books videos, tutorials (Free or Paid), Exploit, CTFs, Hacking Practices etc. which are related to AWS Security
Vulnerable-Flask-App - Intentionally Vulnerable Flask app for use in Demos
BloodHound - Six Degrees of Domain Admin
juice-shop - OWASP Juice Shop: Probably the most modern and sophisticated insecure web application
botocore - The low-level, core functionality of boto3 and the AWS CLI.
crc32 - CRC32 tools: reverse, undo/rewind, and calculate hashes