cloud-security
starsforks
How to install cloud-security?
hypnguyen1209/offensive-claude/cloud-security
$npx -y skills add hypnguyen1209/offensive-claude --skill cloud-securityUse when attacking AWS/Azure/GCP cloud — IAM/identity privilege escalation, IMDS/metadata SSRF, Entra device-code & PRT theft, GCP impersonation chains, Kubernetes/container escape, IaC/CI-CD federation abuse
SKILL.md
| 1 | # Cloud Security & Attack |
| 2 | |
| 3 | ## When to Activate |
| 4 | |
| 5 | - Cloud penetration test / red team against AWS, Azure (Entra ID), or GCP |
| 6 | - IAM / identity privilege escalation and cross-account or cross-tenant pivoting |
| 7 | - Compromised web app or SSRF reachable from cloud compute — harvest metadata credentials |
| 8 | - Kubernetes / container assessment, node breakout, cluster takeover |
| 9 | - CI/CD and IaC review: Terraform state, OIDC federation trust policies, pipeline secrets |
| 10 | - Post-exploitation: secret extraction, lateral movement, persistence in cloud control plane |
| 11 | |
| 12 | ## Technique Map |
| 13 | |
| 14 | | Technique | ATT&CK | CWE | Reference | Script | |
| 15 | |-----------|--------|-----|-----------|--------| |
| 16 | | AWS IAM privesc (CreatePolicyVersion, PassRole, AttachPolicy) | T1098.001 | CWE-269 | references/aws-iam-privesc.md | scripts/aws_privesc_enum.py | |
| 17 | | AWS `sts:AssumeRoot` member-account escalation | T1078.004 | CWE-269 | references/aws-iam-privesc.md | scripts/aws_privesc_enum.py | |
| 18 | | Cross-account confused deputy / missing ExternalId | T1078.004 | CWE-441 | references/aws-iam-privesc.md | scripts/oidc_trust_auditor.py | |
| 19 | | IMDS / metadata SSRF credential theft (AWS/Azure/GCP) | T1552.005 | CWE-918 | references/imds-metadata-ssrf.md | scripts/imds_harvester.py | |
| 20 | | EKS node creds → IRSA / Pod Identity pivot | T1552.007 | CWE-668 | references/imds-metadata-ssrf.md | scripts/imds_harvester.py | |
| 21 | | Entra device-code phishing → PRT / device join | T1528 | CWE-287 | references/azure-entra-attacks.md | scripts/entra_device_code_phish.py | |
| 22 | | FOCI refresh-token family abuse | T1550.001 | CWE-613 | references/azure-entra-attacks.md | scripts/entra_device_code_phish.py | |
| 23 | | Azure Managed Identity / App-Admin → SP escalation | T1098.001 | CWE-269 | references/azure-entra-attacks.md | scripts/imds_harvester.py | |
| 24 | | GCP `actAs` + resource create impersonation chain | T1078.004 | CWE-269 | references/gcp-attacks.md | scripts/gcp_impersonation_mapper.py | |
| 25 | | GCP `serviceAccountTokenCreator` token chains | T1528 | CWE-269 | references/gcp-attacks.md | scripts/gcp_impersonation_mapper.py | |
| 26 | | Vertex AI P4SA / Ray head-node escalation | T1078.004 | CWE-732 | references/gcp-attacks.md | scripts/gcp_impersonation_mapper.py | |
| 27 | | Container escape (runc Leaky Vessels CVE-2024-21626) | T1611 | CWE-668 | references/kubernetes-container-escape.md | - | |
| 28 | | IngressNightmare (CVE-2025-1974) cluster takeover | T1190 | CWE-94 | references/kubernetes-container-escape.md | scripts/k8s_can_i_abuse.py | |
| 29 | | K8s RBAC privesc (pods/exec, token mount, node proxy) | T1078 | CWE-269 | references/kubernetes-container-escape.md | scripts/k8s_can_i_abuse.py | |
| 30 | | Terraform state secret extraction | T1552.001 | CWE-312 | references/iac-secrets-ci-cd.md | scripts/oidc_trust_auditor.py | |
| 31 | | OIDC federation trust-policy abuse (GitHub/TF Cloud) | T1199 | CWE-441 | references/iac-secrets-ci-cd.md | scripts/oidc_trust_auditor.py | |
| 32 | |
| 33 | ## Quick Start |
| 34 | |
| 35 | ```bash |
| 36 | # --- 0. Identify where you are --- |
| 37 | aws sts get-caller-identity # AWS |
| 38 | az account show && az ad signed-in-user show # Azure |
| 39 | gcloud auth list && gcloud config get-value project # GCP |
| 40 | |
| 41 | # --- 1. AWS: enumerate then map privesc paths --- |
| 42 | python3 scripts/aws_privesc_enum.py --profile compromised --json paths.json |
| 43 | cloudfox aws --profile compromised all-checks # alt: broad inventory |
| 44 | pacu # > run iam__enum_permissions ; run iam__privesc_scan |
| 45 | |
| 46 | # --- 2. SSRF / metadata: harvest creds from a reachable compute target --- |
| 47 | python3 scripts/imds_harvester.py --ssrf "https://app/fetch?url=" --provider aws |
| 48 | python3 script |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
