cloudgoat
CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool (by RhinoSecurityLabs)
enumerate-iam
Enumerate the permissions associated with AWS credential set (by andresriancho)
cloudgoat | enumerate-iam | |
---|---|---|
10 | 2 | |
2,752 | 993 | |
12.6% | - | |
6.7 | 0.0 | |
5 days ago | 3 months ago | |
Python | Python | |
BSD 3-clause "New" or "Revised" License | GNU General Public License v3.0 only |
The number of mentions indicates the total number of mentions that we've tracked plus the number of user suggested alternatives.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
cloudgoat
Posts with mentions or reviews of cloudgoat.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2024-04-29.
-
CloudGoat
You can check out the documentation of the scenarios, they list the created AWS resources. The ones I checked looked either free or cheap to me. No guarantee of course and usage can also generate cost.
https://github.com/RhinoSecurityLabs/cloudgoat/blob/master/scenarios/vulnerable_lambda/README.md
-
Launch HN: Corgea (YC S23) – Auto fix vulnerable code
https://github.com/RhinoSecurityLabs/cloudgoat/blob/8ed1cf0e...
Is there something I'm missing?
-
The TISC 2022 Writeup
I tried viewing the other lambda function first, since it's a privilege with the lambda_agent role. I referred to here to help with the code.
- Cloud Pentesting Learning Resources
-
Has anyone took the AWS Pentesting Bootcamp on Pentester Academy?
https://github.com/RhinoSecurityLabs/cloudgoat Good alternative for low cost
-
Hide Your Keys Hide Your Data
Settle your horses. In this post, we will be using CloudGoat. CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool. It allows you to hone your cloud cybersecurity skills by creating and completing several "capture-the-flag" style scenarios. CloudGoat.
-
Pen testing advice
Tryhackme and hackthebox are nice (vulnhub as well), also good to spin up some VMs to test stuff/techniques on. Learn some programming as well. If you're doing cloud testing, Cloudgoat is pretty good (you'll need an aws account first). If web testing, Burpsuite is very helpful. If doing intranet testing, try familiarizing yourself with SysInternals, maybe also Bloodhound, Nmap, etc. Tbh pentesting is a big field in and of itself. Might sometimes feel a bit overwhelming.
- Practice Cloud Security
enumerate-iam
Posts with mentions or reviews of enumerate-iam.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2022-09-15.
-
The TISC 2022 Writeup
┌──(kali㉿kali)-[/tmp] └─$ git clone https://github.com/andresriancho/enumerate-iam.git Cloning into 'enumerate-iam'... remote: Enumerating objects: 56, done. remote: Total 56 (delta 0), reused 0 (delta 0), pack-reused 56 Receiving objects: 100% (56/56), 33.63 KiB | 3.74 MiB/s, done. Resolving deltas: 100% (25/25), done. ┌──(kali㉿kali)-[/tmp] └─$ cd enumerate-iam ┌──(kali㉿kali)-[/tmp/enumerate-iam] └─$ ┌──(kali㉿kali)-[/tmp/enumerate-iam] └─$ python3 ./enumerate-iam.py --access-key AKIAQYDFBGMSUFX5522K --secret-key 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 2022-09-08 10:29:30,843 - 13773 - [INFO] Starting permission enumeration for access-key-id "AKIAQYDFBGMSUFX5522K" 2022-09-08 10:29:32,363 - 13773 - [INFO] -- Account ARN : arn:aws:iam::051751498533:user/user-b464a9d644194b0dafc3d166d36d5c4e 2022-09-08 10:29:32,364 - 13773 - [INFO] -- Account Id : 051751498533 2022-09-08 10:29:32,364 - 13773 - [INFO] -- Account Path: user/user-b464a9d644194b0dafc3d166d36d5c4e 2022-09-08 10:29:32,615 - 13773 - [INFO] Attempting common-service describe / list brute force. 2022-09-08 10:29:35,551 - 13773 - [INFO] -- ec2.describe_regions() worked! 2022-09-08 10:29:36,374 - 13773 - [INFO] -- ec2.describe_vpcs() worked! 2022-09-08 10:29:36,790 - 13773 - [INFO] -- ec2.describe_subnets() worked! 2022-09-08 10:29:36,925 - 13773 - [INFO] -- ec2.describe_route_tables() worked! /home/kali/.local/lib/python3.9/site-packages/botocore/client.py:621: FutureWarning: The rds client is currently using a deprecated endpoint: rds.amazonaws.com. In the next minor version this will be moved to rds.us-east-1.amazonaws.com. See https://github.com/boto/botocore/issues/2705 for more details. warnings.warn( 2022-09-08 10:29:37,139 - 13773 - [INFO] -- ec2.describe_security_groups() worked! /home/kali/.local/lib/python3.9/site-packages/botocore/client.py:621: FutureWarning: The sqs client is currently using a deprecated endpoint: queue.amazonaws.com. In the next minor version this will be moved to sqs.us-east-1.amazonaws.com. See https://github.com/boto/botocore/issues/2705 for more details. warnings.warn( /home/kali/.local/lib/python3.9/site-packages/botocore/client.py:621: FutureWarning: The shield client is currently using a deprecated endpoint: shield.us-east-1.amazonaws.com. In the next minor version this will be moved to shield.us-east-1.amazonaws.com. See https://github.com/boto/botocore/issues/2705 for more details. warnings.warn( 2022-09-08 10:29:45,719 - 13773 - [INFO] -- dynamodb.describe_endpoints() worked! /home/kali/.local/lib/python3.9/site-packages/botocore/client.py:621: FutureWarning: The health client is currently using a deprecated endpoint: health.us-east-1.amazonaws.com. In the next minor version this will be moved to global.health.amazonaws.com. See https://github.com/boto/botocore/issues/2705 for more details. warnings.warn( 2022-09-08 10:29:49,024 - 13773 - [INFO] -- sts.get_session_token() worked! 2022-09-08 10:29:49,284 - 13773 - [INFO] -- sts.get_caller_identity() worked! 2022-09-08 10:29:51,080 - 13773 - [INFO] -- iam.list_roles() worked! 2022-09-08 10:29:52,409 - 13773 - [INFO] -- iam.list_instance_profiles() worked! 2022-09-08 10:29:55,985 - 13773 - [ERROR] Remove globalaccelerator.describe_accelerator_attributes action
-
What can you do in an AWS infrastructure with some leaked credentials? Analysis of what attackers do + How to protect both cloud services and containers using AWS services.
The first thing to do would be to enumerate the permissions that the user has, using the many APIs available, easily automated with this great tool: https://github.com/andresriancho/enumerate-iam
What are some alternatives?
When comparing cloudgoat and enumerate-iam you can also consider the following projects:
awesome-aws-security - Curated list of links, references, books videos, tutorials (Free or Paid), Exploit, CTFs, Hacking Practices etc. which are related to AWS Security
botocore - The low-level, core functionality of boto3 and the AWS CLI.
BloodHound - Six Degrees of Domain Admin
crc32 - CRC32 tools: reverse, undo/rewind, and calculate hashes
juice-shop - OWASP Juice Shop: Probably the most modern and sophisticated insecure web application