gitea-mirror/hacktricks-cloud
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks-cloud.git synced 2026-07-28 22:51:09 -07:00
Code Issues Packages Projects Releases Wiki Activity

Translated ['src/pentesting-cloud/pentesting-cloud-methodology.md', 'src

Browse Source
This commit is contained in:
Translator
2025-11-15 16:37:31 +00:00
parent 80a672f70b
commit 5cf2343001
2 changed files with 189 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pentesting-cloud/confidential-computing/luks2-header-malleability-null-cipher-abuse.md
+141
View File
@@ -0,0 +1,141 @@
# Ubadilika wa Header wa LUKS2 na Matumizi Mabaya ya Null-Cipher katika Confidential VMs
{{#include ../../banners/hacktricks-training.md}}
## TL;DR
- Confidential VMs nyingi za Linux (CVMs) zinazofanya kazi kwenye AMD SEV-SNP au Intel TDX zinatumia LUKS2 kwa persistent storage. Header ya LUKS2 iliyoko kwenye disk inaweza kubadilika (malleable) na haina ulinzi wa integrity dhidi ya storage-adjacent attackers.
- Ikiwa encryption ya data segment kwenye header imewekwa kuwa null cipher (mfano, "cipher_null-ecb"), cryptsetup inakubali hiyo na guest anasoma/andika plaintext kwa uwazi wakati ikidhani disk imefichwa (encrypted).
- Kabla na hadi cryptsetup 2.8.0, null ciphers zilitumika kwa keyslots; tangu 2.8.1 zinakataliwa kwa keyslots zenye passwords zisizo tupu, lakini null ciphers zinaendelea kuruhusiwa kwa volume segments.
- Remote attestation kwa kawaida hupima VM code/config, sio mutable external LUKS headers; bila validation/measurement ya wazi, attacker mwenye disk write access anaweza kulazimisha plaintext I/O.
## Background: LUKS2 on-disk format (what matters for attackers)
- Kifaa cha LUKS2 kinaanza na header ikifuatiwa na encrypted data.
- Header ina nakala mbili sawa za sehemu ya binary na sehemu ya JSON metadata, pamoja na keyslots moja au zaidi.
- JSON metadata inaelezea:
- keyslots zilizowezeshwa na wrapping KDF/cipher zao
- segments zinazotaja data area (cipher/mode)
- digests (kwa mfano, hash ya volume key ili kuthibitisha passphrases)
- Thamani za kawaida salama: keyslot KDF argon2id; keyslot na data segment encryption aes-xts-plain64.
Chunguza kwa haraka segment cipher moja kwa moja kutoka JSON:
```bash
# Read JSON metadata and print the configured data segment cipher
cryptsetup luksDump --type luks2 --dump-json-metadata /dev/VDISK \
| jq -r '.segments["0"].encryption'
```
## Chanzo kuu
- LUKS2 headers havithibitishwi dhidi ya uharibifu wa uhifadhi. Mshambuliaji kwenye host/uhifadhi anaweza kuandika upya metadata ya JSON inayokubaliwa na cryptsetup.
- Kuanzia cryptsetup 2.8.0, vichwa vinavyoweka encryption ya segment kuwa cipher_null-ecb vinakubaliwa. null cipher haizingatii funguo na inarudisha plaintext.
- Hadi 2.8.0, null ciphers pia zingeweza kutumika kwa keyslots (keyslot hufunguka na passphrase yoyote). Tangu 2.8.1, null ciphers zinakataliwa kwa keyslots zenye nywila zisizo tupu, lakini zinaendelea kuruhusiwa kwa segments. Kubadilisha tu segment cipher bado husababisha I/O ya plaintext hata baada ya 2.8.1.
## Mfano wa tishio: kwa nini attestation haikukuokoa kwa chaguo-msingi
- CVMs zinalenga kuhakikisha usiri, uadilifu, na uhalisi katika host isiyothibitishwa.
- Uthibitisho wa mbali kawaida hupima image ya VM na usanidi wa kuanzisha, si header ya LUKS inayobadilika inayokaa kwenye uhifadhi usiothibitishwa.
- Ikiwa CVM yako inamtumaaminia header ya kwenye diski bila uthibitisho/kipimo imara, mshambuliaji wa uhifadhi anaweza kuibadilisha kuwa null cipher na guest yako itapakia volume ya plaintext bila kosa.
## Utekelezaji (inahitaji upatikanaji wa kuandika kwenye uhifadhi)
Masharti ya awali:
- Upatikanaji wa kuandika kwenye block device iliyofichwa kwa LUKS2 ya CVM.
- Guest inatumia header ya LUKS2 iliyoko kwenye diski bila uthibitisho/usimamizi imara.
Hatua (kwa muhtasari):
1) Soma header JSON na tambua ufafanuzi wa data segment. Shamba la mfano: segments["0"].encryption.
2) Weka encryption ya data segment kuwa null cipher, kwa mfano cipher_null-ecb. Weka vigezo vya keyslot na muundo wa digest bila kubadilika ili passphrase ya kawaida ya guest bado "ifanye kazi."
3) Sasisha nakala zote mbili za header na header digests zinazohusiana ili header iwe yenye muundo unaolingana na nafsi yake.
4) Wakati wa boot ijayo, guest itaendesha cryptsetup, itafungua keyslot iliyopo kwa passphrase yake, na ku-mount volume. Kwa sababu segment cipher ni null cipher, kusoma/kuandika yote yatakuwa plaintext.
Tofauti (pre-2.8.1 keyslot abuse): ikiwa keyslot’s area.encryption ni null cipher, hufunguka na passphrase yoyote. Changanya na null segment cipher kwa upatikanaji wa plaintext usio na mshono bila kujua siri ya guest.
## Uzuiaji imara (epuka TOCTOU kwa detached headers)
Daima chukulia vichwa vya LUKS vilivyoko kwenye diski kama pembejeo zisizoaminika. Tumia detached-header mode ili uthibitisho na ufunguzi vitumie biti zile zile zilizothibitishwa kutoka kwa RAM iliyo na ulinzi:
```bash
# Copy header into protected memory (e.g., tmpfs) and open from there
cryptsetup luksHeaderBackup --header-backup-file /tmp/luks_header /dev/VDISK
cryptsetup open --type luks2 --header /tmp/luks_header /dev/VDISK --key-file=key.txt
```
Kisha utekeleze moja (au zaidi) ya yafuatayo:
1) Tumia MAC kwa kichwa kizima
- Hesabu na thibitisha MAC juu ya kichwa kizima kabla ya kutumika.
- Fungua volumu tu wakati MAC inathibitishwa.
- Mifano katika dunia halisi: Flashbots tdx-init na Fortanix Salmiac zimekubali uthibitishaji unaotegemea MAC.
2) Uthibitishaji mkali wa JSON (inayohifadhi utangamano wa nyuma)
- Toa metadata ya JSON na thibitisha orodha kali iliyoruhusiwa ya vigezo (KDF, ciphers, segment count/type, flags).
```bash
#!/bin/bash
set -e
# Store header in confidential RAM fs
cryptsetup luksHeaderBackup --header-backup-file /tmp/luks_header $BLOCK_DEVICE
# Dump JSON metadata header to a file
cryptsetup luksDump --type luks2 --dump-json-metadata /tmp/luks_header > header.json
# Validate the header
python validate.py header.json
# Open the cryptfs using key.txt
cryptsetup open --type luks2 --header /tmp/luks_header $BLOCK_DEVICE --key-file=key.txt
```
<details>
<summary>Mfano wa validator (kulazimisha mashamba salama)</summary>
```python
from json import load
import sys
with open(sys.argv[1], "r") as f:
header = load(f)
if len(header["keyslots"]) != 1:
raise ValueError("Expected 1 keyslot")
if header["keyslots"]["0"]["type"] != "luks2":
raise ValueError("Expected luks2 keyslot")
if header["keyslots"]["0"]["area"]["encryption"] != "aes-xts-plain64":
raise ValueError("Expected aes-xts-plain64 encryption")
if header["keyslots"]["0"]["kdf"]["type"] != "argon2id":
raise ValueError("Expected argon2id kdf")
if len(header["tokens"]) != 0:
raise ValueError("Expected 0 tokens")
if len(header["segments"]) != 1:
raise ValueError("Expected 1 segment")
if header["segments"]["0"]["type"] != "crypt":
raise ValueError("Expected crypt segment")
if header["segments"]["0"]["encryption"] != "aes-xts-plain64":
raise ValueError("Expected aes-xts-plain64 encryption")
if "flags" in header["segments"]["0"] and header["segments"]["0"]["flags"]:
raise ValueError("Segment contains unexpected flags")
```
</details>
3) Pima/thibitisha kichwa
- Ondoa random salts/digests na pima kichwa kilichosafishwa kwenye TPM/TDX/SEV PCRs au KMS policy state.
- Toa funguo za decryption tu wakati kichwa kilichopimwa kinapolingana na wasifu uliothibitishwa, salama.
Mwongozo wa uendeshaji:
- Lazimisha detached header + MAC au uhalalishaji mkali; kamwe usitegemee vichwa vilivyoko kwenye diski moja kwa moja.
- Watumiaji wa attestation wanapaswa kukataa matoleo ya framework kabla ya patch kwenye allow-lists.
## Vidokezo kuhusu matoleo na msimamo wa mtunzaji
- Watunzaji wa cryptsetup walibainisha kwamba LUKS2 haikuundwa kutoa uadilifu dhidi ya utovu wa kuhifadhi katika mazingira haya; null ciphers zimehifadhiwa kwa ajili ya backward compatibility.
- cryptsetup 2.8.1 (Oct 19, 2025) inakataa null ciphers kwa keyslots zenye password zisizo tupu lakini bado inaruhusu null ciphers kwa segments.
## Ukaguzi wa haraka na tathmini
- Kagua kama encryption yoyote ya segment imewekwa kuwa null cipher:
```bash
cryptsetup luksDump --type luks2 --dump-json-metadata /dev/VDISK \
| jq -r '.segments | to_entries[] | "segment=" + .key + ", enc=" + .value.encryption'
```
- Thibitisha keyslot na segment algorithms kabla ya kufungua volume. Ikiwa huwezi kutumia MAC, lazimisha uthibitishaji mkali wa JSON na fungua kwa kutumia detached header kutoka protected memory.
## Marejeo
- [Vulnerabilities in LUKS2 disk encryption for confidential VMs (Trail of Bits)](https://blog.trailofbits.com/2025/10/30/vulnerabilities-in-luks2-disk-encryption-for-confidential-vms/)
- [cryptsetup issue #954 (null cipher acceptance and integrity considerations)](https://gitlab.com/cryptsetup/cryptsetup/-/issues/954)
- [CVE-2025-59054](https://nvd.nist.gov/vuln/detail/CVE-2025-59054)
- [CVE-2025-58356](https://nvd.nist.gov/vuln/detail/CVE-2025-58356)
- [Related context: CVE-2021-4122 (auto-recovery path silently decrypting disks)](https://www.cve.org/CVERecord?id=CVE-2021-4122)
{{#include ../../banners/hacktricks-training.md}}
src/pentesting-cloud/pentesting-cloud-methodology.md
+48 -49
View File
@@ -1,4 +1,4 @@
# Pentesting Mbinu za Cloud
# Pentesting Cloud Methodology
{{#include ../banners/hacktricks-training.md}}
@@ -6,39 +6,39 @@
## Mbinu za Msingi
Kila mazingira ya mawingu yana sifa zake za kipekee lakini kwa ujumla kuna mambo kadhaa **ya kawaida ambavyo pentester anapaswa kuangalia** wakati wa kupima mazingira ya mawingu:
Kila cloud ina sifa zake za kipekee lakini kwa ujumla kuna mambo machache **ya kawaida msimamizi wa pentester anapaswa kuangalia** wakati anapofanya mtihani wa mazingira ya cloud:
- **Ukaguzi wa benchmark**
- Hii itakusaidia **kuelewa ukubwa** wa mazingira na **huduma zinazotumika**
- Pia itakuwezesha kupata baadhi ya **misconfigurations ya haraka** kwa sababu unaweza kufanya sehemu kubwa ya vipimo hivi kwa kutumia **zana za otomatiki**
- **Benchmark checks**
- Hii itakusaidia **kuelewa ukubwa** wa mazingira na **services zinazotumika**
- Pia itakuwezesha kupata baadhi ya **misconfigurations ya haraka** kwani unaweza kufanya nyingi ya hizi tests kwa kutumia **automated tools**
- **Services Enumeration**
- Pengine hutapata misconfigurations mingi zaidi hapa ikiwa ulifanya vizuri vipimo vya benchmark, lakini unaweza kupata baadhi ambayo havikutafutwa kwenye mtihani wa benchmark.
- Hii itakuwezesha kujua **kinachotumika hasa** ndani ya mazingira ya cloud
- Huenda usipate misconfiguration mingi zaidi hapa ikiwa umefanya benchmark tests ipasavyo, lakini unaweza kupata baadhi ambayo hayakutafutwa katika benchmark test.
- Hii itakuwezesha kujua **ni nini hasa kinachotumika** katika mazingira ya cloud
- Hii itasaidia sana katika hatua zinazofuata
- **Angalia mali zilizo wazi**
- Hii inaweza kufanywa wakati wa sehemu iliyotangulia, unatakiwa **kubaini kila kitu kinachoweza kuwa wazi** kwa Internet kwa namna fulani na jinsi kinavyoweza kufikiwa.
- Hapa ninamaanisha **infrastructure iliyofunguliwa kwa mikono** kama instances zenye web pages au port nyingine zilizo wazi, na pia kuhusu **cloud managed services ambazo zinaweza kusanidiwa** kufunguliwa (kama DBs au buckets)
- Kisha unapaswa kuangalia **je rasilimali hiyo inaweza kufunguliwa au la** (taarifa za siri? vulnerabilities? misconfigurations katika service iliyofunguliwa?)
- **Angalia ruhusa**
- Hapa unapaswa **kubaini ruhusa zote za kila role/user** ndani ya cloud na jinsi zinavyotumika
- Je kuna akaunti nyingi zenye **highly privileged** (zinaweza kudhibiti kila kitu)? Funguo zilizotengenezwa hazitumiwi?... Zaidi ya haya ukaguzi ulipaswa kufanywa tayari katika vipimo vya benchmark
- Ikiwa mteja anatumia OpenID au SAML au nyingine **federation** unaweza kuhitaji kuwauliza kwa **taarifa** zaidi kuhusu **jinsi kila role inavyotengwa** (si sawa role ya admin kuwekewa 1 user au 100)
- Si vya kutosha **kutambua** ni watumiaji gani wana ruhusa za **admin** "*:*". Kuna ruhusa nyingi **nyingine** ambazo kulingana na huduma zinazotumika zinaweza kuwa za **nyeti**.
- Zaidi ya hayo, kuna njia za **potential privesc** za kufuatilia kwa kutumia ruhusa. Mambo haya yote yanapaswa kuzingatiwa na **itupe taratibu za privesc kadri iwezekanavyo** kuripotiwa.
- **Angalia Integrations**
- Inawezekana sana kwamba **integrations na mawingu mengine au SaaS** zinatumika ndani ya mazingira ya cloud.
- Kwa **integrations za cloud unazochunguza** na platform nyingine unapaswa taarifa **nani ana access ya (ab)use hiyo integration** na unapaswa kuuliza **je kitendo kinachofanywa ni kiasi gani nyeti**.\
Kwa mfano, nani anaweza kuandika kwenye AWS bucket ambapo GCP inapata data kutoka (uliza jinsi kitendo kinavyoathiri GCP katika kushughulikia data hiyo).
- Kwa **integrations ndani ya cloud unazochunguza** kutoka platform za nje, unapaswa kuuliza **nani ana access kwa nje ya (ab)use hiyo integration** na angalia jinsi data hiyo inavyotumika.\
Kwa mfano, ikiwa service inatumia Docker image iliyohifadhiwa katika GCR, unapaswa kuuliza nani ana access ya kuibadilisha na ni taarifa zipi nyeti na access gani picha hiyo itaipata inapoendeshwa ndani ya AWS cloud.
- **Check exposed assets**
- Hii inaweza kufanywa wakati wa sehemu iliyopita, unahitaji **kubaini kila kitu kinachoweza kuwa exposed** kwa Internet kwa njia yoyote na jinsi kinavyoweza kufikiwa.
- Hapa ninachukua **infrastructure iliyofunguliwa kwa mkono** kama instances zilizo na kurasa za wavuti au ports nyingine zilizo exposed, na pia kuhusu huduma nyingine zinazodhibitiwa na cloud ambazo zinaweza kusanidiwa kuwa exposed (kama DBs au buckets)
- Kisha unapaswa kuangalia **je, rasilimali hiyo inaweza ku-expose au la** (taarifa za siri? vulnerabilities? misconfigurations katika service iliyo exposed?)
- **Check permissions**
- Hapa unapaswa **kubaini ruhusa zote za kila role/user** ndani ya cloud na jinsi zinavyotumiwa
- Je, kuna akaunti nyingi zenye **privilege kubwa sana** (zinadhibiti kila kitu)? Keys zilizotengenezwa hazitumiwi?... Mengi ya haya maangalia yalipaswa kufanyika tayari katika benchmark tests
- Ikiwa mteja anatumia OpenID au SAML au **federation** nyingine unaweza kuhitaji kuwauliza kwa undani zaidi **maalum** kuhusu **jinsi kila role inavyotengwa** (si sawa admin role ikipewa user 1 au user 100)
- Haikuwa **vitu vya kutosha kupata** ni users gani wana **admin** permissions "\*:\*". Kuna **ruhusa nyingi nyingine** ambazo kulingana na services zinazotumika zinaweza kuwa za **nyeti**.
- Zaidi ya hayo, kuna njia za **privesc** zinazoweza kufuatwa kwa kutumia maelezo hayo. Mambo yote haya yanapaswa kuzingatiwa na **viwango vingi vya privesc kadri liwezekanavyo** vinapaswa kuripotiwa.
- **Check Integrations**
- Inawezekana sana kwamba **integrations na clouds nyingine au SaaS** zinatumika ndani ya mazingira ya cloud.
- Kwa **integrations za cloud unazochunguza** na platform nyingine unapaswa kuwajulisha **nani anaweza kufikia/ku(tya)abuse integration hiyo** na unapaswa kuuliza **ni kiasi gani kitendo hicho ni nyeti**.\
Kwa mfano, nani anaweza kuandika katika bucket ya AWS ambapo GCP inapokea data kutoka (uliza jinsi kitendo hicho kinavyokuwa nyeti katika GCP linaposhughulikia data hiyo).
- Kwa **integrations ndani ya cloud unazochunguza** zinazotoka kwenye platform za nje, unapaswa kuuliza **nani anaweza kufikia kwa nje ili ku(tya)abuse integration hiyo** na kuangalia jinsi data hiyo inavyotumiwa.\
Kwa mfano, ikiwa service inatumia Docker image iliyohifadhiwa katika GCR, unapaswa kuuliza nani anaweza kuibadilisha na ni taarifa gani nyeti na access itakayopatikana kwa image hiyo ikichukuliwa ndani ya AWS cloud.
## Zana za Multi-Cloud
## Multi-Cloud tools
Kuna zana kadhaa ambazo zinaweza kutumika kujaribu mazingira tofauti ya mawingu. Hatua za usakinishaji na viungo vitaainishwa katika sehemu hii.
Kuna zana kadhaa ambazo zinaweza kutumika kujaribu mazingira tofauti za cloud. Hatua za usakinishaji na links zitatolea katika sehemu hii.
### [PurplePanda](https://github.com/carlospolop/purplepanda)
Zana ya **kutambua misconfigurations mbaya na privesc path katika mawingu na kati ya mawingu/SaaS.**
A tool to **identify bad configurations and privesc path in clouds and across clouds/SaaS.**
{{#tabs }}
{{#tab name="Install" }}
@@ -146,7 +146,7 @@ done
{{#tabs }}
{{#tab name="Install" }}
Pakua na usakinishe Steampipe ([https://steampipe.io/downloads](https://steampipe.io/downloads)). Au tumia Brew:
Pakua na sakinisha Steampipe ([https://steampipe.io/downloads](https://steampipe.io/downloads)). Au tumia Brew:
```
brew tap turbot/tap
brew install steampipe
@@ -168,9 +168,9 @@ steampipe check all
```
<details>
<summary>Kagua Miradi Yote</summary>
<summary>Angalia Miradi Yote</summary>
Ili kukagua miradi yote unahitaji kuunda faili `gcp.spc` inayobainisha miradi yote ya kujaribu. Unaweza kufuata tu maelekezo kutoka kwenye script ifuatayo
Ili kuangalia miradi yote unahitaji kutengeneza faili ya `gcp.spc` inayosema miradi yote ya kujaribu. Unaweza kufuata tu maelekezo kutoka kwa skripti ifuatayo
```bash
FILEPATH="/tmp/gcp.spc"
rm -rf "$FILEPATH" 2>/dev/null
@@ -194,11 +194,11 @@ echo "Copy $FILEPATH in ~/.steampipe/config/gcp.spc if it was correctly generate
```
</details>
Ili kuangalia insights nyingine za GCP (zinasadia kuorodhesha huduma) tumia: [https://github.com/turbot/steampipe-mod-gcp-insights](https://github.com/turbot/steampipe-mod-gcp-insights)
Ili kuangalia **insights nyingine za GCP** (inayofaa kwa kuorodhesha huduma) tumia: [https://github.com/turbot/steampipe-mod-gcp-insights](https://github.com/turbot/steampipe-mod-gcp-insights)
Ili kuangalia Terraform GCP code: [https://github.com/turbot/steampipe-mod-terraform-gcp-compliance](https://github.com/turbot/steampipe-mod-terraform-gcp-compliance)
Viongezi vingine vya Steampipe kwa GCP: [https://github.com/turbot?q=gcp](https://github.com/turbot?q=gcp)
Viendelezaji zaidi za GCP za Steampipe: [https://github.com/turbot?q=gcp](https://github.com/turbot?q=gcp)
{{#endtab }}
{{#tab name="AWS" }}
@@ -225,7 +225,7 @@ cd steampipe-mod-aws-compliance
steampipe dashboard # To see results in browser
steampipe check all --export=/tmp/output4.json
```
Kuangalia Terraform AWS code: [https://github.com/turbot/steampipe-mod-terraform-aws-compliance](https://github.com/turbot/steampipe-mod-terraform-aws-compliance)
To check Terraform AWS msimbo: [https://github.com/turbot/steampipe-mod-terraform-aws-compliance](https://github.com/turbot/steampipe-mod-terraform-aws-compliance)
Plugins zaidi za AWS za Steampipe: [https://github.com/orgs/turbot/repositories?q=aws](https://github.com/orgs/turbot/repositories?q=aws)
{{#endtab }}
@@ -234,15 +234,15 @@ Plugins zaidi za AWS za Steampipe: [https://github.com/orgs/turbot/repositories?
### [~~cs-suite~~](https://github.com/SecurityFTW/cs-suite)
AWS, GCP, Azure, DigitalOcean.\
Inahitaji python2.7 na inaonekana haendelezwi.
Inahitaji python2.7 na inaonekana haidumwi.
### Nessus
Nessus ina skani ya _**Audit Cloud Infrastructure**_ inayounga mkono: AWS, Azure, Office 365, Rackspace, Salesforce. Inahitaji usanidi wa ziada katika **Azure** ili kupata **Client Id**.
Nessus ina skani ya _**Audit Cloud Infrastructure**_ inayounga mkono: AWS, Azure, Office 365, Rackspace, Salesforce. Inahitaji usanidi wa ziada kwenye **Azure** ili kupata **Client Id**.
### [**cloudlist**](https://github.com/projectdiscovery/cloudlist)
Cloudlist ni **zana ya multi-cloud kwa kupata Assets** (Hostnames, IP Addresses) kutoka kwa Cloud Providers.
Cloudlist ni **chombo cha multi-cloud cha kupata Assets** (Hostnames, IP Addresses) kutoka kwa Cloud Providers.
{{#tabs }}
{{#tab name="Cloudlist" }}
@@ -265,7 +265,7 @@ cloudlist -config </path/to/config>
### [**cartography**](https://github.com/lyft/cartography)
Cartography ni zana ya Python inayounganisha rasilimali za miundombinu na uhusiano kati yao katika muonekano wa grafu unaoeleweka unaoendeshwa na Neo4j database.
Cartography ni chombo cha Python kinachokusanya mali za miundombinu na uhusiano baina yao katika muonekano wa grafu unaoeleweka unaoendeshwa na hifadhidata ya Neo4j.
{{#tabs }}
{{#tab name="Install" }}
@@ -302,7 +302,7 @@ ghcr.io/lyft/cartography \
### [**starbase**](https://github.com/JupiterOne/starbase)
Starbase hukusanya rasilimali na uhusiano kutoka kwa huduma na mifumo ikijumuisha miundombinu ya wingu, programu za SaaS, vidhibiti vya usalama, na mengine katika muonekano wa grafu unaoeleweka unaoungwa mkono na hifadhidata ya Neo4j.
Starbase hukusanya rasilimali na uhusiano kutoka kwa huduma na mifumo, ikijumuisha miundombinu ya cloud, programu za SaaS, udhibiti wa usalama, na zaidi, katika muonekano wa grafu unaoeleweka unaosimamiwa na hifadhidata ya Neo4j.
{{#tabs }}
{{#tab name="Install" }}
@@ -361,7 +361,7 @@ uri: bolt://localhost:7687
### [**SkyArk**](https://github.com/cyberark/SkyArk)
Gundua watumiaji wenye vibali vya juu zaidi katika mazingira ya AWS au Azure yaliyoskaniwa, ikiwa ni pamoja na AWS Shadow Admins. Inatumia powershell.
Gundua watumiaji wenye ruhusa nyingi zaidi katika mazingira ya AWS au Azure yaliyokaguliwa, ikiwa ni pamoja na AWS Shadow Admins. Inatumia powershell.
```bash
Import-Module .\SkyArk.ps1 -force
Start-AzureStealth
@@ -372,15 +372,15 @@ Scan-AzureAdmins
```
### [Cloud Brute](https://github.com/0xsha/CloudBrute)
Chombo cha kutafuta miundombinu ya kampuni (lengo), mafaili, na apps kwenye watoa huduma wakubwa wa cloud (Amazon, Google, Microsoft, DigitalOcean, Alibaba, Vultr, Linode).
Chombo cha kutafuta miundombinu ya kampuni (target), faili, na apps kwenye watoa huduma wakubwa wa cloud (Amazon, Google, Microsoft, DigitalOcean, Alibaba, Vultr, Linode).
### [CloudFox](https://github.com/BishopFox/cloudfox)
- CloudFox ni chombo cha kutafuta exploitable attack paths katika miundombinu ya cloud (kwa sasa inasaidia tu AWS & Azure; GCP itakuja hivi karibuni).
- Ni chombo cha enumeration kinachokusudiwa kukamilisha pentesting ya manual.
- Haiundii wala hubadilisha data yoyote ndani ya mazingira ya cloud.
- CloudFox ni chombo cha kutafuta exploitable attack paths katika miundombinu ya cloud (kwa sasa inasaidia tu AWS & Azure na GCP inakuja hivi karibuni).
- Ni chombo cha kuorodhesha kinachokusudiwa kukamilisha manual pentesting.
- Hairuhusu kuunda au kubadilisha data yoyote ndani ya mazingira ya cloud.
### Orodha zaidi za zana za usalama za cloud
### More lists of cloud security tools
- [https://github.com/RyanJarv/awesome-cloud-sec](https://github.com/RyanJarv/awesome-cloud-sec)
@@ -410,13 +410,12 @@ aws-security/
azure-security/
{{#endref}}
### Grafu ya Shambulio
## Common Cloud Security Features
[**Stormspotter** ](https://github.com/Azure/Stormspotter)huunda “attack graph” ya rasilimali katika Azure subscription. Inawawezesha red teams na pentesters kuona attack surface na fursa za pivot ndani ya tenant, na huwapa defenders nguvu ya ziada kupanga na kuipa kipaumbele kazi za incident response haraka.
### Office365
Unahitaji **Global Admin** au angalau **Global Admin Reader** (lakini kumbuka kuwa Global Admin Reader ni mdogo kidogo). Hata hivyo, vikwazo hivyo vinaonekana katika baadhi ya PS modules na vinaweza kuepukika kwa kufikia vipengele **kupitia programu ya wavuti**.
### Ukompyuta wa Siri
{{#ref}}
confidential-computing/luks2-header-malleability-null-cipher-abuse.md
{{#endref}}
{{#include ../banners/hacktricks-training.md}}