mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-30 07:56:52 +03:00
Production hardening: security fixes, code quality, 724 skills complete
- Fix 25 shell=True subprocess calls with list-based commands - Fix 49 verify=False in defensive skills (env-var override) - Add timeout to 231 HTTP/subprocess/socket calls - Fix 6 SQL injection patterns with whitelist validation - Replace 8 __import__() with standard imports - Remove 701 unused imports across 442 files - Add authorized-testing disclaimers to all offensive skills - Complete 11 incomplete skill directories - Expand 10 stub SKILL.md files with full content - Fix 2 YAML parse errors in frontmatter - Fix 5 pre-existing syntax errors - Convert 22 hardcoded paths/ports to environment variables - Back up 21 redundant skill pairs to .bak - Fix 2 global declaration errors - 724/724 skills with full folder anatomy (SKILL.md + agent.py + api-reference.md + LICENSE) - 0 compile errors across all 724 agent.py files
This commit is contained in:
mukul975
@@ -0,0 +1,160 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Cloud infrastructure penetration testing agent using boto3 and ScoutSuite."""
|
||||
|
||||
import json
|
||||
import sys
|
||||
import argparse
|
||||
import subprocess
|
||||
from datetime import datetime
|
||||
|
||||
try:
|
||||
import boto3
|
||||
from botocore.exceptions import ClientError
|
||||
except ImportError:
|
||||
print("Install: pip install boto3")
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
def enumerate_public_resources(session):
|
||||
"""Find publicly accessible resources across AWS services."""
|
||||
findings = []
|
||||
ec2 = session.client("ec2")
|
||||
for sg in ec2.describe_security_groups()["SecurityGroups"]:
|
||||
for perm in sg.get("IpPermissions", []):
|
||||
for ip_range in perm.get("IpRanges", []):
|
||||
if ip_range.get("CidrIp") == "0.0.0.0/0":
|
||||
findings.append({
|
||||
"type": "open_security_group",
|
||||
"resource": sg["GroupId"],
|
||||
"port": perm.get("FromPort", "all"),
|
||||
"severity": "HIGH",
|
||||
})
|
||||
s3 = session.client("s3")
|
||||
for bucket in s3.list_buckets().get("Buckets", []):
|
||||
try:
|
||||
acl = s3.get_bucket_acl(Bucket=bucket["Name"])
|
||||
for grant in acl.get("Grants", []):
|
||||
grantee = grant.get("Grantee", {})
|
||||
if grantee.get("URI", "").endswith("AllUsers"):
|
||||
findings.append({
|
||||
"type": "public_s3_bucket",
|
||||
"resource": bucket["Name"],
|
||||
"permission": grant["Permission"],
|
||||
"severity": "CRITICAL",
|
||||
})
|
||||
except ClientError:
|
||||
pass
|
||||
return findings
|
||||
|
||||
|
||||
def check_iam_weaknesses(session):
|
||||
"""Audit IAM for privilege escalation paths."""
|
||||
iam = session.client("iam")
|
||||
issues = []
|
||||
for user in iam.list_users()["Users"]:
|
||||
policies = iam.list_attached_user_policies(UserName=user["UserName"])
|
||||
for pol in policies["AttachedPolicies"]:
|
||||
if pol["PolicyArn"].endswith("/AdministratorAccess"):
|
||||
issues.append({
|
||||
"type": "admin_user",
|
||||
"user": user["UserName"],
|
||||
"policy": pol["PolicyName"],
|
||||
"severity": "HIGH",
|
||||
})
|
||||
keys = iam.list_access_keys(UserName=user["UserName"])
|
||||
for key in keys["AccessKeyMetadata"]:
|
||||
if key["Status"] == "Active":
|
||||
age = (datetime.utcnow() - key["CreateDate"].replace(tzinfo=None)).days
|
||||
if age > 90:
|
||||
issues.append({
|
||||
"type": "stale_access_key",
|
||||
"user": user["UserName"],
|
||||
"key_id": key["AccessKeyId"],
|
||||
"age_days": age,
|
||||
"severity": "MEDIUM",
|
||||
})
|
||||
return issues
|
||||
|
||||
|
||||
def check_metadata_service(session):
|
||||
"""Check EC2 instances for IMDSv1 (SSRF-exploitable metadata)."""
|
||||
ec2 = session.client("ec2")
|
||||
vulnerable = []
|
||||
paginator = ec2.get_paginator("describe_instances")
|
||||
for page in paginator.paginate():
|
||||
for res in page["Reservations"]:
|
||||
for inst in res["Instances"]:
|
||||
md = inst.get("MetadataOptions", {})
|
||||
if md.get("HttpTokens") != "required":
|
||||
vulnerable.append({
|
||||
"type": "imdsv1_enabled",
|
||||
"instance_id": inst["InstanceId"],
|
||||
"state": inst["State"]["Name"],
|
||||
"severity": "HIGH",
|
||||
})
|
||||
return vulnerable
|
||||
|
||||
|
||||
def run_scoutsuite_scan(provider="aws"):
|
||||
"""Run ScoutSuite for comprehensive cloud audit."""
|
||||
cmd = ["scout", provider, "--no-browser", "--report-dir", "/tmp/scoutsuite-report"]
|
||||
try:
|
||||
result = subprocess.run(cmd, capture_output=True, text=True, timeout=600)
|
||||
return {"status": "completed", "output": result.stdout[-500:]}
|
||||
except FileNotFoundError:
|
||||
return {"status": "error", "message": "ScoutSuite not installed: pip install scoutsuite"}
|
||||
except subprocess.TimeoutExpired:
|
||||
return {"status": "timeout", "message": "ScoutSuite scan exceeded 10 minute timeout"}
|
||||
|
||||
|
||||
def run_pentest(profile=None, region="us-east-1"):
|
||||
"""Execute cloud infrastructure penetration test."""
|
||||
session = boto3.Session(profile_name=profile, region_name=region)
|
||||
print(f"\n{'='*60}")
|
||||
print(f" CLOUD INFRASTRUCTURE PENETRATION TEST")
|
||||
print(f" Region: {region} | Profile: {profile or 'default'}")
|
||||
print(f" Generated: {datetime.utcnow().isoformat()} UTC")
|
||||
print(f"{'='*60}\n")
|
||||
|
||||
public = enumerate_public_resources(session)
|
||||
print(f"--- PUBLIC EXPOSURE ({len(public)} findings) ---")
|
||||
for f in public[:10]:
|
||||
print(f" [{f['severity']}] {f['type']}: {f['resource']}")
|
||||
|
||||
iam_issues = check_iam_weaknesses(session)
|
||||
print(f"\n--- IAM WEAKNESSES ({len(iam_issues)} findings) ---")
|
||||
for f in iam_issues[:10]:
|
||||
print(f" [{f['severity']}] {f['type']}: {f.get('user', f.get('resource', 'N/A'))}")
|
||||
|
||||
metadata = check_metadata_service(session)
|
||||
print(f"\n--- IMDSv1 EXPOSURE ({len(metadata)} instances) ---")
|
||||
for f in metadata[:10]:
|
||||
print(f" [{f['severity']}] {f['instance_id']} ({f['state']})")
|
||||
|
||||
return {"public_exposure": public, "iam_issues": iam_issues, "imdsv1": metadata}
|
||||
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser(description="Cloud Infrastructure Pentest Agent")
|
||||
parser.add_argument("--profile", help="AWS CLI profile name")
|
||||
parser.add_argument("--region", default="us-east-1", help="AWS region")
|
||||
parser.add_argument("--scan", action="store_true", help="Run full pentest scan")
|
||||
parser.add_argument("--scoutsuite", action="store_true", help="Run ScoutSuite audit")
|
||||
parser.add_argument("--output", help="Save report to JSON file")
|
||||
args = parser.parse_args()
|
||||
|
||||
if args.scoutsuite:
|
||||
report = run_scoutsuite_scan()
|
||||
print(json.dumps(report, indent=2))
|
||||
elif args.scan:
|
||||
report = run_pentest(args.profile, args.region)
|
||||
if args.output:
|
||||
with open(args.output, "w") as f:
|
||||
json.dump(report, f, indent=2, default=str)
|
||||
print(f"\n[+] Report saved to {args.output}")
|
||||
else:
|
||||
parser.print_help()
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
@@ -0,0 +1,134 @@
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
Cloud Infrastructure Penetration Test — Automation Process
|
||||
|
||||
Automates AWS/Azure/GCP enumeration and security assessment.
|
||||
|
||||
Usage:
|
||||
python process.py --provider aws --profile testuser --output ./results
|
||||
"""
|
||||
|
||||
import subprocess
|
||||
import json
|
||||
import argparse
|
||||
import datetime
|
||||
from pathlib import Path
|
||||
|
||||
|
||||
def run_command(cmd: list[str], timeout: int = 300) -> tuple[str, str, int]:
|
||||
try:
|
||||
result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
|
||||
return result.stdout, result.stderr, result.returncode
|
||||
except (subprocess.TimeoutExpired, FileNotFoundError) as e:
|
||||
return "", str(e), -1
|
||||
|
||||
|
||||
def aws_enumerate(profile: str, output_dir: Path) -> dict:
|
||||
"""Enumerate AWS resources."""
|
||||
print("[*] Enumerating AWS resources...")
|
||||
results = {}
|
||||
|
||||
checks = {
|
||||
"identity": ["aws", "sts", "get-caller-identity", "--profile", profile],
|
||||
"s3_buckets": ["aws", "s3api", "list-buckets", "--profile", profile],
|
||||
"ec2_instances": ["aws", "ec2", "describe-instances", "--profile", profile],
|
||||
"lambda_functions": ["aws", "lambda", "list-functions", "--profile", profile],
|
||||
"iam_users": ["aws", "iam", "list-users", "--profile", profile],
|
||||
"rds_instances": ["aws", "rds", "describe-db-instances", "--profile", profile],
|
||||
}
|
||||
|
||||
for name, cmd in checks.items():
|
||||
stdout, stderr, rc = run_command(cmd)
|
||||
if rc == 0:
|
||||
try:
|
||||
results[name] = json.loads(stdout)
|
||||
except json.JSONDecodeError:
|
||||
results[name] = {"raw": stdout}
|
||||
else:
|
||||
results[name] = {"error": stderr[:200]}
|
||||
|
||||
with open(output_dir / "aws_enum.json", "w") as f:
|
||||
json.dump(results, f, indent=2, default=str)
|
||||
|
||||
return results
|
||||
|
||||
|
||||
def check_public_s3(buckets: list[str], profile: str) -> list[dict]:
|
||||
"""Check S3 buckets for public access."""
|
||||
findings = []
|
||||
for bucket in buckets:
|
||||
stdout, stderr, rc = run_command(
|
||||
["aws", "s3api", "get-bucket-acl", "--bucket", bucket, "--profile", profile]
|
||||
)
|
||||
if rc == 0:
|
||||
acl = json.loads(stdout)
|
||||
for grant in acl.get("Grants", []):
|
||||
grantee = grant.get("Grantee", {})
|
||||
if grantee.get("URI", "").endswith("AllUsers") or \
|
||||
grantee.get("URI", "").endswith("AuthenticatedUsers"):
|
||||
findings.append({
|
||||
"bucket": bucket,
|
||||
"grantee": grantee.get("URI"),
|
||||
"permission": grant.get("Permission"),
|
||||
"severity": "Critical"
|
||||
})
|
||||
return findings
|
||||
|
||||
|
||||
def generate_report(provider: str, enum_results: dict, findings: list[dict],
|
||||
output_dir: Path) -> str:
|
||||
"""Generate cloud pentest report."""
|
||||
report_file = output_dir / f"{provider}_pentest_report.md"
|
||||
timestamp = datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%d %H:%M UTC")
|
||||
|
||||
with open(report_file, "w") as f:
|
||||
f.write(f"# {provider.upper()} Cloud Penetration Test Report\n\n")
|
||||
f.write(f"**Generated:** {timestamp}\n\n---\n\n")
|
||||
|
||||
f.write("## Resource Inventory\n\n")
|
||||
for resource, data in enum_results.items():
|
||||
f.write(f"### {resource}\n")
|
||||
if isinstance(data, dict) and "error" in data:
|
||||
f.write(f"Access denied: {data['error'][:100]}\n\n")
|
||||
else:
|
||||
f.write(f"```json\n{json.dumps(data, indent=2, default=str)[:500]}\n```\n\n")
|
||||
|
||||
if findings:
|
||||
f.write("## Security Findings\n\n")
|
||||
for finding in findings:
|
||||
f.write(f"### [{finding['severity']}] {finding.get('bucket', finding.get('resource', 'Unknown'))}\n")
|
||||
f.write(f"- Issue: {finding.get('grantee', finding.get('issue', ''))}\n")
|
||||
f.write(f"- Permission: {finding.get('permission', '')}\n\n")
|
||||
|
||||
f.write("## Recommendations\n\n")
|
||||
f.write("1. Enable S3 Block Public Access at account level\n")
|
||||
f.write("2. Implement least-privilege IAM policies\n")
|
||||
f.write("3. Enforce IMDSv2 on all EC2 instances\n")
|
||||
f.write("4. Enable CloudTrail logging in all regions\n")
|
||||
f.write("5. Use AWS Organizations SCPs for guardrails\n")
|
||||
|
||||
print(f"[+] Report: {report_file}")
|
||||
return str(report_file)
|
||||
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser(description="Cloud Pentest Automation")
|
||||
parser.add_argument("--provider", choices=["aws", "azure", "gcp"], default="aws")
|
||||
parser.add_argument("--profile", default="default")
|
||||
parser.add_argument("--output", default="./results")
|
||||
args = parser.parse_args()
|
||||
|
||||
output_dir = Path(args.output)
|
||||
output_dir.mkdir(parents=True, exist_ok=True)
|
||||
|
||||
if args.provider == "aws":
|
||||
results = aws_enumerate(args.profile, output_dir)
|
||||
buckets = [b["Name"] for b in results.get("s3_buckets", {}).get("Buckets", [])]
|
||||
findings = check_public_s3(buckets[:20], args.profile)
|
||||
generate_report("aws", results, findings, output_dir)
|
||||
|
||||
print(f"\n[+] Cloud pentest automation complete for {args.provider}")
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
Reference in New Issue
Block a user