gitea-mirror/hacktricks-cloud
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks-cloud.git synced 2025-12-31 15:05:44 -08:00
Code Issues Packages Projects Releases Wiki Activity

Translated ['src/README.md', 'src/banners/hacktricks-training.md', 'src/

Browse Source
This commit is contained in:
Translator
2024-12-31 20:29:08 +00:00
parent 2753c75e8b
commit 396dbafaf2
245 changed files with 9878 additions and 12609 deletions
Download Patch File Download Diff File Expand all files Collapse all files

218
src/pentesting-cloud/aws-security/README.md
View File

@@ -2,17 +2,17 @@
{{#include ../../banners/hacktricks-training.md}}
## Basic Information
## Basiese Inligting
**Before start pentesting** an **AWS** environment there are a few **basics things you need to know** about how AWS works to help you understand what you need to do, how to find misconfigurations and how to exploit them.
**Voordat jy begin pentesting** 'n **AWS** omgewing, is daar 'n paar **basiese dinge wat jy moet weet** oor hoe AWS werk om jou te help verstaan wat jy moet doen, hoe om miskonfigurasies te vind en hoe om dit te benut.
Concepts such as organization hierarchy, IAM and other basic concepts are explained in:
Konsepte soos organisasiehiërargie, IAM en ander basiese konsepte word verduidelik in:
{{#ref}}
aws-basic-information/
{{#endref}}
## Labs to learn
## Laboratoriums om te leer
- [https://github.com/RhinoSecurityLabs/cloudgoat](https://github.com/RhinoSecurityLabs/cloudgoat)
- [https://github.com/BishopFox/iam-vulnerable](https://github.com/BishopFox/iam-vulnerable)
@@ -22,49 +22,49 @@ aws-basic-information/
- [http://flaws.cloud/](http://flaws.cloud/)
- [http://flaws2.cloud/](http://flaws2.cloud/)
Tools to simulate attacks:
Gereedskap om aanvalle te simuleer:
- [https://github.com/Datadog/stratus-red-team/](https://github.com/Datadog/stratus-red-team/)
- [https://github.com/sbasu7241/AWS-Threat-Simulation-and-Detection/tree/main](https://github.com/sbasu7241/AWS-Threat-Simulation-and-Detection/tree/main)
## AWS Pentester/Red Team Methodology
## AWS Pentester/Red Team Metodologie
In order to audit an AWS environment it's very important to know: which **services are being used**, what is **being exposed**, who has **access** to what, and how are internal AWS services an **external services** connected.
Om 'n AWS omgewing te oudit, is dit baie belangrik om te weet: watter **dienste gebruik word**, wat is **blootgestel**, wie het **toegang** tot wat, en hoe is interne AWS dienste en **eksterne dienste** gekoppel.
From a Red Team point of view, the **first step to compromise an AWS environment** is to manage to obtain some **credentials**. Here you have some ideas on how to do that:
Vanuit 'n Red Team perspektief, is die **eerste stap om 'n AWS omgewing te kompromitteer** om daarin te slaag om 'n paar **akkrediteerbare** te verkry. Hier is 'n paar idees oor hoe om dit te doen:
- **Leaks** in github (or similar) - OSINT
- **Social** Engineering
- **Password** reuse (password leaks)
- Vulnerabilities in AWS-Hosted Applications
- [**Server Side Request Forgery**](https://book.hacktricks.xyz/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf) with access to metadata endpoint
- **Local File Read**
- `/home/USERNAME/.aws/credentials`
- `C:\Users\USERNAME\.aws\credentials`
- 3rd parties **breached**
- **Internal** Employee
- [**Cognito** ](aws-services/aws-cognito-enum/#cognito)credentials
- **Leaks** in github (of soortgelyk) - OSINT
- **Sosiale** Ingenieurswese
- **Wagwoord** hergebruik (wagwoordlekke)
- Kw vulnerabilities in AWS-gehoste toepassings
- [**Server Side Request Forgery**](https://book.hacktricks.xyz/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf) met toegang tot metadata-eindpunt
- **Plaaslike Lêer Lees**
- `/home/USERNAME/.aws/credentials`
- `C:\Users\USERNAME\.aws\credentials`
- 3de partye **gekompromitteer**
- **Interne** Werknemer
- [**Cognito** ](aws-services/aws-cognito-enum/#cognito)akkrediteerbare
Or by **compromising an unauthenticated service** exposed:
Of deur **'n nie-geauthentiseerde diens** wat blootgestel is te kompromitteer:
{{#ref}}
aws-unauthenticated-enum-access/
{{#endref}}
Or if you are doing a **review** you could just **ask for credentials** with these roles:
Of as jy 'n **hersiening** doen, kan jy net **vraag vir akkrediteerbare** met hierdie rolle:
{{#ref}}
aws-permissions-for-a-pentest.md
{{#endref}}
> [!NOTE]
> After you have managed to obtain credentials, you need to know **to who do those creds belong**, and **what they have access to**, so you need to perform some basic enumeration:
> Nadat jy daarin geslaag het om akkrediteerbare te verkry, moet jy weet **aan wie behoort daardie akkrediteerbare**, en **waartoe hulle toegang het**, so jy moet 'n paar basiese enumerasie uitvoer:
## Basic Enumeration
## Basiese Enumerasie
### SSRF
If you found a SSRF in a machine inside AWS check this page for tricks:
As jy 'n SSRF in 'n masjien binne AWS gevind het, kyk na hierdie bladsy vir truuks:
{{#ref}}
https://book.hacktricks.xyz/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf
@@ -72,8 +72,7 @@ https://book.hacktricks.xyz/pentesting-web/ssrf-server-side-request-forgery/clou
### Whoami
One of the first things you need to know is who you are (in where account you are in other info about the AWS env):
Een van die eerste dinge wat jy moet weet is wie jy is (in watter rekening jy is en ander inligting oor die AWS omgewing):
```bash
# Easiest way, but might be monitored?
aws sts get-caller-identity
@@ -89,117 +88,113 @@ aws sns publish --topic-arn arn:aws:sns:us-east-1:*account id*:aaa --message aaa
TOKEN=`curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"`
curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/dynamic/instance-identity/document
```
> [!CAUTION]
> Note that companies might use **canary tokens** to identify when **tokens are being stolen and used**. It's recommended to check if a token is a canary token or not before using it.\
> For more info [**check this page**](aws-services/aws-security-and-detection-services/aws-cloudtrail-enum.md#honeytokens-bypass).
> Let daarop dat maatskappye **kanarie tokens** kan gebruik om te identifiseer wanneer **tokens gesteel en gebruik** word. Dit word aanbeveel om te kontroleer of 'n token 'n kanarie token is of nie voordat jy dit gebruik.\
> Vir meer inligting [**kyk na hierdie bladsy**](aws-services/aws-security-and-detection-services/aws-cloudtrail-enum.md#honeytokens-bypass).
### Org Enumeration
### Organisasie Enumerasie
{{#ref}}
aws-services/aws-organizations-enum.md
{{#endref}}
### IAM Enumeration
### IAM Enumerasie
If you have enough permissions **checking the privileges of each entity inside the AWS account** will help you understand what you and other identities can do and how to **escalate privileges**.
As jy genoeg regte het, sal **die privileges van elke entiteit binne die AWS-rekening nagaan** jou help om te verstaan wat jy en ander identiteite kan doen en hoe om **privileges te verhoog**.
If you don't have enough permissions to enumerate IAM, you can **steal bruteforce them** to figure them out.\
Check **how to do the numeration and brute-forcing** in:
As jy nie genoeg regte het om IAM te enumerate nie, kan jy dit **steal bruteforce** om dit uit te vind.\
Kyk **hoe om die numerasie en bruteforcing** te doen in:
{{#ref}}
aws-services/aws-iam-enum.md
{{#endref}}
> [!NOTE]
> Now that you **have some information about your credentials** (and if you are a red team hopefully you **haven't been detected**). It's time to figure out which services are being used in the environment.\
> In the following section you can check some ways to **enumerate some common services.**
> Nou dat jy **'n paar inligting oor jou akrediteer** (en as jy 'n rooi span is hoop ek jy **is nie opgespoor nie**). Dit is tyd om uit te vind watter dienste in die omgewing gebruik word.\
> In die volgende afdeling kan jy 'n paar maniere kyk om **'n paar algemene dienste te enumerate.**
## Services Enumeration, Post-Exploitation & Persistence
## Dienste Enumerasie, Post-Exploitation & Persistensie
AWS has an astonishing amount of services, in the following page you will find **basic information, enumeration** cheatsheets\*\*,\*\* how to **avoid detection**, obtain **persistence**, and other **post-exploitation** tricks about some of them:
AWS het 'n verbasende hoeveelheid dienste, in die volgende bladsy sal jy **basiese inligting, enumerasie** cheatsheets\*\*,\*\* hoe om **opsporing te vermy**, **persistensie** te verkry, en ander **post-exploitation** truuks oor sommige van hulle vind:
{{#ref}}
aws-services/
{{#endref}}
Note that you **don't** need to perform all the work **manually**, below in this post you can find a **section about** [**automatic tools**](./#automated-tools).
Let daarop dat jy **nie** al die werk **handmatig** hoef te doen nie, hieronder in hierdie pos kan jy 'n **afdeling oor** [**outomatiese gereedskap**](./#automated-tools) vind.
Moreover, in this stage you might discovered **more services exposed to unauthenticated users,** you might be able to exploit them:
Boonop, in hierdie fase mag jy **meer dienste ontdek wat aan nie-geverifieerde gebruikers blootgestel is,** jy mag in staat wees om dit te benut:
{{#ref}}
aws-unauthenticated-enum-access/
{{#endref}}
## Privilege Escalation
## Privilege Verhoging
If you can **check at least your own permissions** over different resources you could **check if you are able to obtain further permissions**. You should focus at least in the permissions indicated in:
As jy **ten minste jou eie regte** oor verskillende hulpbronne kan **nagaan**, kan jy **nagaan of jy in staat is om verdere regte te verkry**. Jy moet ten minste fokus op die regte wat in:
{{#ref}}
aws-privilege-escalation/
{{#endref}}
## Publicly Exposed Services
## Publiek Blootgestelde Dienste
While enumerating AWS services you might have found some of them **exposing elements to the Internet** (VM/Containers ports, databases or queue services, snapshots or buckets...).\
As pentester/red teamer you should always check if you can find **sensitive information / vulnerabilities** on them as they might provide you **further access into the AWS account**.
Terwyl jy AWS-dienste enumerate, mag jy sommige van hulle gevind het wat **elemente aan die Internet blootstel** (VM/Containers poorte, databasisse of wagdiens, snapshots of emmers...).\
As pentester/rooi spaner moet jy altyd kyk of jy **sensitiewe inligting / kwesbaarhede** op hulle kan vind aangesien dit jou **verdere toegang tot die AWS-rekening** kan bied.
In this book you should find **information** about how to find **exposed AWS services and how to check them**. About how to find **vulnerabilities in exposed network services** I would recommend you to **search** for the specific **service** in:
In hierdie boek behoort jy **inligting** te vind oor hoe om **blootgestelde AWS-dienste te vind en hoe om dit te kontroleer**. Oor hoe om **kwesbaarhede in blootgestelde netwerkdienste** te vind, sou ek jou aanbeveel om te **soek** na die spesifieke **diens** in:
{{#ref}}
https://book.hacktricks.xyz/
{{#endref}}
## Compromising the Organization
## Kompromitering van die Organisasie
### From the root/management account
### Van die wortel/ bestuursrekening
When the management account creates new accounts in the organization, a **new role** is created in the new account, by default named **`OrganizationAccountAccessRole`** and giving **AdministratorAccess** policy to the **management account** to access the new account.
Wanneer die bestuursrekening nuwe rekeninge in die organisasie skep, word 'n **nuwe rol** in die nuwe rekening geskep, standaard genoem **`OrganizationAccountAccessRole`** en gee **AdministratorAccess** beleid aan die **bestuursrekening** om toegang tot die nuwe rekening te verkry.
<figure><img src="../../images/image (171).png" alt=""><figcaption></figcaption></figure>
So, in order to access as administrator a child account you need:
So, om as administrateur toegang tot 'n kindrekening te verkry, moet jy:
- **Compromise** the **management** account and find the **ID** of the **children accounts** and the **names** of the **role** (OrganizationAccountAccessRole by default) allowing the management account to access as admin.
- To find children accounts go to the organizations section in the aws console or run `aws organizations list-accounts`
- You cannot find the name of the roles directly, so check all the custom IAM policies and search any allowing **`sts:AssumeRole` over the previously discovered children accounts**.
- **Compromise** a **principal** in the management account with **`sts:AssumeRole` permission over the role in the children accounts** (even if the account is allowing anyone from the management account to impersonate, as its an external account, specific `sts:AssumeRole` permissions are necessary).
- **Kompromiteer** die **bestuurs** rekening en vind die **ID** van die **kindrekening** en die **name** van die **rol** (OrganizationAccountAccessRole per standaard) wat die bestuursrekening toelaat om as admin toegang te verkry.
- Om kindrekeninge te vind, gaan na die organisasieseksie in die aws-konsol of voer `aws organizations list-accounts` uit.
- Jy kan nie die name van die rolle direk vind nie, so kyk na al die persoonlike IAM-beleide en soek enige wat **`sts:AssumeRole` oor die voorheen ontdekte kindrekeninge** toelaat.
- **Kompromiteer** 'n **hoof** in die bestuursrekening met **`sts:AssumeRole` toestemming oor die rol in die kindrekeninge** (selfs as die rekening enige iemand van die bestuursrekening toelaat om te verpersoonlik, aangesien dit 'n eksterne rekening is, is spesifieke `sts:AssumeRole` toestemmings nodig).
## Automated Tools
## Outomatiese Gereedskap
### Recon
- [**aws-recon**](https://github.com/darkbitio/aws-recon): A multi-threaded AWS security-focused **inventory collection tool** written in Ruby.
- [**aws-recon**](https://github.com/darkbitio/aws-recon): 'n multi-draad AWS sekuriteitsgefokusde **inventaris versamelingsgereedskap** geskryf in Ruby.
```bash
# Install
gem install aws_recon
# Recon and get json
AWS_PROFILE=<profile> aws_recon \
--services S3,EC2 \
--regions global,us-east-1,us-east-2 \
--verbose
--services S3,EC2 \
--regions global,us-east-1,us-east-2 \
--verbose
```
- [**cloudlist**](https://github.com/projectdiscovery/cloudlist): Cloudlist is a **multi-cloud tool for getting Assets** (Hostnames, IP Addresses) from Cloud Providers.
- [**cloudmapper**](https://github.com/duo-labs/cloudmapper): CloudMapper helps you analyze your Amazon Web Services (AWS) environments. It now contains much more functionality, including auditing for security issues.
- [**cloudlist**](https://github.com/projectdiscovery/cloudlist): Cloudlist is 'n **multi-cloud hulpmiddel om Bate** (Gasname, IP Adresse) van Cloud Verskaffers te verkry.
- [**cloudmapper**](https://github.com/duo-labs/cloudmapper): CloudMapper help jou om jou Amazon Web Services (AWS) omgewings te analiseer. Dit bevat nou baie meer funksionaliteit, insluitend ouditering vir sekuriteitskwessies.
```bash
# Installation steps in github
# Create a config.json file with the aws info, like:
{
"accounts": [
{
"default": true,
"id": "<account id>",
"name": "dev"
}
],
"cidrs":
{
"2.2.2.2/28": {"name": "NY Office"}
}
"accounts": [
{
"default": true,
"id": "<account id>",
"name": "dev"
}
],
"cidrs":
{
"2.2.2.2/28": {"name": "NY Office"}
}
}
# Enumerate
@@ -229,9 +224,7 @@ python3 cloudmapper.py public --accounts dev
python cloudmapper.py prepare #Prepare webserver
python cloudmapper.py webserver #Show webserver
```
- [**cartography**](https://github.com/lyft/cartography): Cartography is a Python tool that consolidates infrastructure assets and the relationships between them in an intuitive graph view powered by a Neo4j database.
- [**cartography**](https://github.com/lyft/cartography): Cartography is 'n Python-gereedskap wat infrastruktuur bates en die verhoudings tussen hulle in 'n intuïtiewe grafiekweergave saamvoeg, aangedryf deur 'n Neo4j-databasis.
```bash
# Install
pip install cartography
@@ -240,17 +233,15 @@ pip install cartography
# Get AWS info
AWS_PROFILE=dev cartography --neo4j-uri bolt://127.0.0.1:7687 --neo4j-password-prompt --neo4j-user neo4j
```
- [**starbase**](https://github.com/JupiterOne/starbase): Starbase collects assets and relationships from services and systems including cloud infrastructure, SaaS applications, security controls, and more into an intuitive graph view backed by the Neo4j database.
- [**aws-inventory**](https://github.com/nccgroup/aws-inventory): (Uses python2) This is a tool that tries to **discover all** [**AWS resources**](https://docs.aws.amazon.com/general/latest/gr/glos-chap.html#resource) created in an account.
- [**aws_public_ips**](https://github.com/arkadiyt/aws_public_ips): It's a tool to **fetch all public IP addresses** (both IPv4/IPv6) associated with an AWS account.
- [**starbase**](https://github.com/JupiterOne/starbase): Starbase versamel bates en verhoudings van dienste en stelsels, insluitend wolkinfrastruktuur, SaaS-toepassings, sekuriteitsbeheer en meer in 'n intuïtiewe grafiekweergave wat deur die Neo4j-databasis ondersteun word.
- [**aws-inventory**](https://github.com/nccgroup/aws-inventory): (Gebruik python2) Dit is 'n hulpmiddel wat probeer om **alle** [**AWS hulpbronne**](https://docs.aws.amazon.com/general/latest/gr/glos-chap.html#resource) wat in 'n rekening geskep is, te **ontdek**.
- [**aws_public_ips**](https://github.com/arkadiyt/aws_public_ips): Dit is 'n hulpmiddel om **alle publieke IP-adresse** (beide IPv4/IPv6) wat met 'n AWS-rekening geassosieer is, te **verkry**.
### Privesc & Exploiting
- [**SkyArk**](https://github.com/cyberark/SkyArk)**:** Discover the most privileged users in the scanned AWS environment, including the AWS Shadow Admins. It uses powershell. You can find the **definition of privileged policies** in the function **`Check-PrivilegedPolicy`** in [https://github.com/cyberark/SkyArk/blob/master/AWStealth/AWStealth.ps1](https://github.com/cyberark/SkyArk/blob/master/AWStealth/AWStealth.ps1).
- [**pacu**](https://github.com/RhinoSecurityLabs/pacu): Pacu is an open-source **AWS exploitation framework**, designed for offensive security testing against cloud environments. It can **enumerate**, find **miss-configurations** and **exploit** them. You can find the **definition of privileged permissions** in [https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/iam\_\_privesc_scan/main.py#L134](https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/iam__privesc_scan/main.py#L134) inside the **`user_escalation_methods`** dict.
- Note that pacu **only checks your own privescs paths** (not account wide).
- [**SkyArk**](https://github.com/cyberark/SkyArk)**:** Ontdek die mees bevoorregte gebruikers in die gescande AWS-omgewing, insluitend die AWS Shadow Admins. Dit gebruik powershell. Jy kan die **definisie van bevoorregte beleide** in die funksie **`Check-PrivilegedPolicy`** vind in [https://github.com/cyberark/SkyArk/blob/master/AWStealth/AWStealth.ps1](https://github.com/cyberark/SkyArk/blob/master/AWStealth/AWStealth.ps1).
- [**pacu**](https://github.com/RhinoSecurityLabs/pacu): Pacu is 'n oopbron **AWS eksploitering raamwerk**, ontwerp vir offensiewe sekuriteitstoetsing teen wolkomgewings. Dit kan **opnoem**, **mis-konfigurasies** vind en dit **eksploiteer**. Jy kan die **definisie van bevoorregte toestemmings** vind in [https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/iam\_\_privesc_scan/main.py#L134](https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/iam__privesc_scan/main.py#L134) binne die **`user_escalation_methods`** dict.
- Let daarop dat pacu **slegs jou eie privesc-paaie nagaan** (nie rekeningwyd nie).
```bash
# Install
## Feel free to use venvs
@@ -264,9 +255,7 @@ pacu
> exec iam__enum_permissions # Get permissions
> exec iam__privesc_scan # List privileged permissions
```
- [**PMapper**](https://github.com/nccgroup/PMapper): Principal Mapper (PMapper) is a script and library for identifying risks in the configuration of AWS Identity and Access Management (IAM) for an AWS account or an AWS organization. It models the different IAM Users and Roles in an account as a directed graph, which enables checks for **privilege escalation** and for alternate paths an attacker could take to gain access to a resource or action in AWS. You can check the **permissions used to find privesc** paths in the filenames ended in `_edges.py` in [https://github.com/nccgroup/PMapper/tree/master/principalmapper/graphing](https://github.com/nccgroup/PMapper/tree/master/principalmapper/graphing)
- [**PMapper**](https://github.com/nccgroup/PMapper): Principal Mapper (PMapper) is 'n skrif en biblioteek vir die identifisering van risiko's in die konfigurasie van AWS Identity and Access Management (IAM) vir 'n AWS-rekening of 'n AWS-organisasie. Dit modelleer die verskillende IAM-gebruikers en rolle in 'n rekening as 'n gerigte grafiek, wat toelaat dat kontroles vir **privilege escalation** en vir alternatiewe paaie wat 'n aanvaller kan neem om toegang tot 'n hulpbron of aksie in AWS te verkry, gedoen word. Jy kan die **permissions used to find privesc** paaie in die lêername wat eindig op `_edges.py` in [https://github.com/nccgroup/PMapper/tree/master/principalmapper/graphing](https://github.com/nccgroup/PMapper/tree/master/principalmapper/graphing) nagaan.
```bash
# Install
pip install principalmapper
@@ -288,10 +277,8 @@ pmapper --profile dev query 'preset privesc *' # Get privescs with admins
pmapper --profile dev orgs create
pmapper --profile dev orgs display
```
- [**cloudsplaining**](https://github.com/salesforce/cloudsplaining): Cloudsplaining is an AWS IAM Security Assessment tool that identifies violations of least privilege and generates a risk-prioritized HTML report.\
It will show you potentially **over privileged** customer, inline and aws **policies** and which **principals has access to them**. (It not only checks for privesc but also other kind of interesting permissions, recommended to use).
- [**cloudsplaining**](https://github.com/salesforce/cloudsplaining): Cloudsplaining is 'n AWS IAM Sekuriteitsbeoordeling hulpmiddel wat oortredings van die minste voorreg identifiseer en 'n risiko-geprioritiseerde HTML-verslag genereer.\
Dit sal jou moontlik **oorvoorregte** kliënt, inline en aws **beleide** wys en watter **beginsels toegang tot hulle het**. (Dit kontroleer nie net vir privesc nie, maar ook ander soort interessante toestemmings, dit word aanbeveel om te gebruik).
```bash
# Install
pip install cloudsplaining
@@ -303,24 +290,20 @@ cloudsplaining download --profile dev
# Analyze the IAM policies
cloudsplaining scan --input-file /private/tmp/cloudsplaining/dev.json --output /tmp/files/
```
- [**cloudjack**](https://github.com/prevade/cloudjack): CloudJack assesses AWS accounts for **subdomain hijacking vulnerabilities** as a result of decoupled Route53 and CloudFront configurations.
- [**ccat**](https://github.com/RhinoSecurityLabs/ccat): List ECR repos -> Pull ECR repo -> Backdoor it -> Push backdoored image
- [**Dufflebag**](https://github.com/bishopfox/dufflebag): Dufflebag is a tool that **searches** through public Elastic Block Storage (**EBS) snapshots for secrets** that may have been accidentally left in.
- [**cloudjack**](https://github.com/prevade/cloudjack): CloudJack evalueer AWS-rekeninge vir **subdomein-hijacking kwesbaarhede** as gevolg van ontkoppelde Route53 en CloudFront konfigurasies.
- [**ccat**](https://github.com/RhinoSecurityLabs/ccat): Lys ECR repos -> Trek ECR repo -> Agterdeur dit -> Stoot agterdeur beeld
- [**Dufflebag**](https://github.com/bishopfox/dufflebag): Dufflebag is 'n hulpmiddel wat **soek** deur openbare Elastic Block Storage (**EBS) snappies vir geheime** wat dalk per ongeluk agtergelaat is.
### Audit
- [**cloudsploit**](https://github.com/aquasecurity/cloudsploit)**:** CloudSploit by Aqua is an open-source project designed to allow detection of **security risks in cloud infrastructure** accounts, including: Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP), Oracle Cloud Infrastructure (OCI), and GitHub (It doesn't look for ShadowAdmins).
- [**cloudsploit**](https://github.com/aquasecurity/cloudsploit)**:** CloudSploit deur Aqua is 'n oopbronprojek wat ontwerp is om die opsporing van **veiligheidsrisiko's in wolkinfrastruktuur** rekeninge moontlik te maak, insluitend: Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP), Oracle Cloud Infrastructure (OCI), en GitHub (Dit soek nie na ShadowAdmins nie).
```bash
./index.js --csv=file.csv --console=table --config ./config.js
# Compiance options: --compliance {hipaa,cis,cis1,cis2,pci}
## use "cis" for cis level 1 and 2
```
- [**Prowler**](https://github.com/prowler-cloud/prowler): Prowler is an Open Source security tool to perform AWS security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness.
- [**Prowler**](https://github.com/prowler-cloud/prowler): Prowler is 'n Open Source sekuriteitstoepassing om AWS sekuriteit beste praktyke assesserings, ouditte, insidentrespons, deurlopende monitering, verharding en forensiese gereedheid uit te voer.
```bash
# Install python3, jq and git
# Install
@@ -331,15 +314,11 @@ prowler -v
prowler <provider>
prowler aws --profile custom-profile [-M csv json json-asff html]
```
- [**CloudFox**](https://github.com/BishopFox/cloudfox): CloudFox helps you gain situational awareness in unfamiliar cloud environments. It’s an open source command line tool created to help penetration testers and other offensive security professionals find exploitable attack paths in cloud infrastructure.
- [**CloudFox**](https://github.com/BishopFox/cloudfox): CloudFox help jou om situasionele bewustheid te verkry in onbekende wolkomgewings. Dit is 'n oopbron-opdraglyn hulpmiddel wat geskep is om penetrasietoetsers en ander offensiewe sekuriteitsprofessionals te help om ontginbare aanvalspaaie in wolkinfrastruktuur te vind.
```bash
cloudfox aws --profile [profile-name] all-checks
```
- [**ScoutSuite**](https://github.com/nccgroup/ScoutSuite): Scout Suite is an open source multi-cloud security-auditing tool, which enables security posture assessment of cloud environments.
- [**ScoutSuite**](https://github.com/nccgroup/ScoutSuite): Scout Suite is 'n oopbron multi-cloud sekuriteitsouditering hulpmiddel, wat sekuriteitsposisie assessering van wolkomgewings moontlik maak.
```bash
# Install
virtualenv -p python3 venv
@@ -350,18 +329,16 @@ scout --help
# Get info
scout aws -p dev
```
- [**cs-suite**](https://github.com/SecurityFTW/cs-suite): Cloud Security Suite (gebruik python2.7 en lyk ononderhoude)
- [**Zeus**](https://github.com/DenizParlak/Zeus): Zeus is 'n kragtige hulpmiddel vir AWS EC2 / S3 / CloudTrail / CloudWatch / KMS beste versterking praktyke (lyk ononderhoude). Dit kontroleer slegs standaard geconfigureerde kredensies binne die stelsel.
- [**cs-suite**](https://github.com/SecurityFTW/cs-suite): Cloud Security Suite (uses python2.7 and looks unmaintained)
- [**Zeus**](https://github.com/DenizParlak/Zeus): Zeus is a powerful tool for AWS EC2 / S3 / CloudTrail / CloudWatch / KMS best hardening practices (looks unmaintained). It checks only default configured creds inside the system.
### Konstante Oudit
### Constant Audit
- [**cloud-custodian**](https://github.com/cloud-custodian/cloud-custodian): Cloud Custodian is a rules engine for managing public cloud accounts and resources. It allows users to **define policies to enable a well managed cloud infrastructure**, that's both secure and cost optimized. It consolidates many of the adhoc scripts organizations have into a lightweight and flexible tool, with unified metrics and reporting.
- [**pacbot**](https://github.com/tmobile/pacbot)**: Policy as Code Bot (PacBot)** is a platform for **continuous compliance monitoring, compliance reporting and security automation for the clou**d. In PacBot, security and compliance policies are implemented as code. All resources discovered by PacBot are evaluated against these policies to gauge policy conformance. The PacBot **auto-fix** framework provides the ability to automatically respond to policy violations by taking predefined actions.
- [**streamalert**](https://github.com/airbnb/streamalert)**:** StreamAlert is a serverless, **real-time** data analysis framework which empowers you to **ingest, analyze, and alert** on data from any environment, u**sing data sources and alerting logic you define**. Computer security teams use StreamAlert to scan terabytes of log data every day for incident detection and response.
## DEBUG: Capture AWS cli requests
- [**cloud-custodian**](https://github.com/cloud-custodian/cloud-custodian): Cloud Custodian is 'n reëlsengine vir die bestuur van openbare wolk rekeninge en hulpbronne. Dit stel gebruikers in staat om **beleide te definieer om 'n goed bestuurde wolkinfrastruktuur te enable**, wat beide veilig en koste-geoptimaliseer is. Dit konsolideer baie van die ad-hoc skripte wat organisasies het in 'n liggewig en buigsame hulpmiddel, met verenigde metrieke en verslagdoening.
- [**pacbot**](https://github.com/tmobile/pacbot)**: Policy as Code Bot (PacBot)** is 'n platform vir **deurlopende nakoming monitering, nakoming verslagdoening en sekuriteit outomatisering vir die wolk**. In PacBot word sekuriteit en nakoming beleide as kode geïmplementeer. Alle hulpbronne wat deur PacBot ontdek word, word geëvalueer teen hierdie beleide om beleidskonformiteit te meet. Die PacBot **auto-fix** raamwerk bied die vermoë om outomaties te reageer op beleids oortredings deur vooraf gedefinieerde aksies te neem.
- [**streamalert**](https://github.com/airbnb/streamalert)**:** StreamAlert is 'n serverless, **regte-tyd** data analise raamwerk wat jou in staat stel om **data van enige omgewing in te neem, te analiseer en te waarsku** , met **data bronne en waarskuwing logika wat jy definieer**. Rekenaar sekuriteitspanne gebruik StreamAlert om terabytes van logdata elke dag te skandeer vir insidentdetectie en -reaksie.
## DEBUG: Capture AWS cli versoeke
```bash
# Set proxy
export HTTP_PROXY=http://localhost:8080
@@ -380,14 +357,9 @@ export AWS_CA_BUNDLE=~/Downloads/certificate.pem
# Run aws cli normally trusting burp cert
aws ...
```
## References
## Verwysings
- [https://www.youtube.com/watch?v=8ZXRw4Ry3mQ](https://www.youtube.com/watch?v=8ZXRw4Ry3mQ)
- [https://cloudsecdocs.com/aws/defensive/tooling/audit/](https://cloudsecdocs.com/aws/defensive/tooling/audit/)
{{#include ../../banners/hacktricks-training.md}}