cyber-security-resources/cloud_resources/README.md

Cloud Security Resources

• Cloud Security Resources from AWS
• Penetration Testing Rules of Engagement in Microsoft Azure
• Penetration Testing in AWS
• Penetration Testing in Google Cloud Platform and Cloud Security FAQ
• Google Cloud Security Center
• High-level Best Practices when Performing Pen Testing in Cloud Environments

Vulnerables

• CloudGoat
• Damn Vulnerable Cloud Application(DVCA)
• PENETRATION TESTING AWS STORAGE: KICKING THE S3 BUCKET - Written by Dwight Hohnstein from Rhino Security Labs.

Additional Tools

• Taken - Takeover AWS Ips And Have A Working POC For Subdomain Takeover
• Autovpn - Create On Demand Disposable OpenVPN Endpoints On AWS
• SpaceSiren - A Honey Token Manager And Alert System For AWS
• AWS Recon - Multi-threaded AWS Inventory Collection Tool With A Focus On Security-Relevant Resources And Metadata
• DAGOBAH - Open Source Tool To Generate Internal Threat Intelligence, Inventory & Compliance Data From AWS Resources
• AWS Report - A Tool For Analyzing Amazon Resources
• SkyArk - Helps To Discover, Assess And Secure The Most Privileged Entities In Azure And AWS
• Cloudsplaining - An AWS IAM Security Assessment Tool That Identifies Violations Of Least Privilege And Generates A Risk-Prioritized Report
• SkyWrapper - Tool That Helps To Discover Suspicious Creation Forms And Uses Of Temporary Tokens In AWS
• Sandcastle - A Python Script For AWS S3 Bucket Enumeration
• Awspx - A Graph-Based Tool For Visualizing Effective Access And Resource Relationships In AWS Environments
• AWSGen.py - Generates Permutations, Alterations And Mutations Of AWS S3 Buckets Names
• AlertResponder - Automatic Security Alert Response Framework By AWS Serverless Application Model
• Aaia - AWS Identity And Access Management Visualizer And Anomaly Finder
• FireProx - AWS API Gateway Management Tool For Creating On The Fly HTTP Pass-Through Proxies For Unique IP Rotation

Azure

Enumeration Tools

Email and Username Enumeration

• o365creeper - Enumerate valid email addresses
• Office 365 User Enumeration - Enumerate valid usernames from Office 365

Cloud Infrastructure Enumeration

• CloudBrute - Find a cloud infrastructure of a company
• cloud_enum - Multi-cloud OSINT tool
• Azucar - Security auditing tool for Azure environments

Azure Specific Enumeration

• BlobHunter - Scanning Azure blob storage accounts
• Grayhat Warfare - Open Azure blobs search
• Azure-AccessPermissions - Enumerate access permissions in Azure AD

Information Gathering Tools

Azure Information Gathering

• o365recon - Information gathering with valid credentials to Azure
• Azurite - Enumeration and reconnaissance in Microsoft Azure Cloud
• Sparrow.ps1 - Detect possible compromised accounts in Azure/M365
• Microsoft Azure AD Assessment - Assessing Azure AD tenant state

Multi-Cloud Security Auditing

• ScoutSuite - Multi-cloud security auditing tool
• Prowler - AWS and Azure security assessments

Lateral Movement Tools

• Stormspotter - Azure Red Team tool
• AzureADLateralMovement - Lateral Movement graph for Azure AD
• SkyArk - Privileged entities in Azure and AWS

Exploitation Tools

Azure Exploitation

• MicroBurst - Scripts for assessing Microsoft Azure security
• Microsoft-Teams-GIFShell - Microsoft Teams reverse shell execution

Credential Attacks

• MSOLSpray - Password spraying tool for Microsoft Online accounts
• MFASweep - Check if MFA is enabled on multiple Microsoft Services Resources
• adconnectdump - Dump Azure AD Connect credentials

Resources

Articles

• Abusing Azure AD SSO with the Primary Refresh Token
• Abusing dynamic groups in Azure AD for Privilege Escalation
• Attacking Azure, Azure AD, and Introducing PowerZure
• Attacking Azure & Azure AD, Part II
• Azure AD Connect for Red Teamers
• Azure AD Introduction for Red Teamers
• Azure AD Pass The Certificate
• Azure AD privilege escalation - Taking over default application permissions as Application Admin
• Defense and Detection for Attacks Within Azure
• Hunting Azure Admins for Vertical Escalation
• Impersonating Office 365 Users With Mimikatz
• Lateral Movement from Azure to On-Prem AD
• Malicious Azure AD Application Registrations
• Moving laterally between Azure AD joined machines
• CrowdStrike Launches Free Tool to Identify and Help Mitigate Risks in Azure Active Directory
• Privilege Escalation Vulnerability in Azure Functions
• Azure Application Proxy C2
• Recovering Plaintext Passwords from Azure Virtual Machines like It’s the 1990s
• Forensicating Azure VMs
• Network Forensics on Azure VMs
• Cross-Account Container Takeover in Azure Container Instances
• Azure Active Directory password brute-forcing flaw
• How to Detect Azure Active Directory Backdoors: Identity Federation
• Azure App Service vulnerability exposed hundreds of source code repositories
• AutoWarp: Cross-Account Vulnerability in Microsoft Azure Automation Service
• Microsoft Azure Synapse Pwnalytics
• Microsoft Azure Site Recovery DLL Hijacking
• FabriXss (CVE-2022-35829): Abusing a Custom Role User Using CSTI and Stored XSS in Azure Fabric Explorer
• Untangling Azure Active Directory Principals & Access Permissions
• How to Detect OAuth Access Token Theft in Azure
• How to deal with Ransomware on Azure
• How Orca found Server-Side Request Forgery (SSRF) Vulnerabilities in four different Azure Services
• EmojiDeploy: Smile! Your Azure web service just got RCE’d
• Bounce the Ticket and Silver Iodide on Azure AD Kerberos

Lists and Cheat Sheets

• List of all Microsoft Portals
• Azure Articles from NetSPI
• Azure Cheat Sheet on CloudSecDocs
• Resources about Azure from Cloudberry Engineering
• Resources from PayloadsAllTheThings
• Encyclopedia on Hacking the Cloud
• Azure AD - Attack and Defense Playbook
• Azure Security Resources and Notes
• Azure Threat Research Matrix

Lab Exercises

• azure-security-lab - Securing Azure Infrastructure - Hands on Lab Guide
• AzureSecurityLabs - Hands-on Security Labs focused on Azure IaaS Security
• Building Free Active Directory Lab in Azure
• Aria Cloud Penetration Testing Tools Container - A Docker container for remote penetration testing
• PurpleCloud - Multi-use Hybrid + Identity Cyber Range implementing a small Active Directory Domain in Azure alongside Azure AD and Azure Domain Services
• BlueCloud - Cyber Range system with a Windows VM for security testing with Azure and AWS Terraform support
• Azure Red Team Attack and Detect Workshop
• SANS Workshop – Building an Azure Pentest Lab for Red Teams - The link in the description contains a password-protected OVA file that can be used until 2nd March 2024

Talks and Videos

• Attacking and Defending the Microsoft Cloud (Office 365 & Azure AD
  • Presentation Slides
• TR19: I'm in your cloud, reading everyone's emails - hacking Azure AD via Active Directory
  • Presentation Slides
• Dirk Jan Mollema - Im In Your Cloud Pwning Your Azure Environment - DEF CON 27 Conference
  • Presentation Slides
• Adventures in Azure Privilege Escalation Karl Fosaaen
  • Presentation Slides
• Introducing ROADtools - Azure AD exploration for Red Teams and Blue Teams

Public Cloud Governance

AWS Governance

• AWS CloudFormation Guard

• AWS CodePipeline Governance

• AWS Config Rules Development Kit

• AWS Control Tower Customizations

• AWS Security Hub Automated Response and Remediation

• AWS Vault

• AWS Well Architected Labs

• AWS - Patterns

URL Services

Service	URL
s3	https://{user_provided}.s3.amazonaws.com
cloudfront	https://{random_id}.cloudfront.net
ec2	ec2-{ip-seperated}.compute-1.amazonaws.com
es	https://{user_provided}-{random_id}.{region}.es.amazonaws.com
elb	http://{user_provided}-{random_id}.{region}.elb.amazonaws.com:80/443
elbv2	https://{user_provided}-{random_id}.{region}.elb.amazonaws.com
rds	mysql://{user_provided}.{random_id}.{region}.rds.amazonaws.com:3306
rds	postgres://{user_provided}.{random_id}.{region}.rds.amazonaws.com:5432
route 53	{user_provided}
execute-api	https://{random_id}.execute-api.{region}.amazonaws.com/{user_provided}
cloudsearch	https://doc-{user_provided}-{random_id}.{region}.cloudsearch.amazonaws.com
transfer	sftp://s-{random_id}.server.transfer.{region}.amazonaws.com
iot	mqtt://{random_id}.iot.{region}.amazonaws.com:8883
iot	https://{random_id}.iot.{region}.amazonaws.com:8443
iot	https://{random_id}.iot.{region}.amazonaws.com:443
mq	https://b-{random_id}-{1,2}.mq.{region}.amazonaws.com:8162
mq	ssl://b-{random_id}-{1,2}.mq.{region}.amazonaws.com:61617
kafka	b-{1,2,3,4}.{user_provided}.{random_id}.c{1,2}.kafka.{region}.amazonaws.com
kafka	{user_provided}.{random_id}.c{1,2}.kafka.useast-1.amazonaws.com
cloud9	https://{random_id}.vfs.cloud9.{region}.amazonaws.com
mediastore	https://{random_id}.data.mediastore.{region}.amazonaws.com
kinesisvideo	https://{random_id}.kinesisvideo.{region}.amazonaws.com
mediaconvert	https://{random_id}.mediaconvert.{region}.amazonaws.com
mediapackage	https://{random_id}.mediapackage.{region}.amazonaws.com/in/v1/{random_id}/channel

MultiCloud Governance

• Cloud Custodian
• CloudQuary
• Cloudsploit
• ManageIQ by RedHat
• Mist.io
• NeuVector
• Triton by Joyent

Kubernetes Operators

• Aqua
  • Aqua Security Operator
  • Starboard Operator
• Misc
  • Anchore - Anchore Engine Operator
  • Falco Security - Falco Operator
  • Quay - Project Quay Container Security
  • Snyk - Snyk Operator
  • Splunk - Splunk Operator for Kubernetes
  • Sysdig - Sysdig Agent Operator

Container Tools

• Anchore
  • Anchore Engine
  • Grype
  • Kai
  • Syft
• Aqua
  • Cloudsploit
  • Kube-Bench
  • Kube-Hunter
  • Kubectl-who-can
  • Trivy
• Misc
  • Docker - Docker Bench for Security
  • Elias - Dagda
  • Falco Security - Falco
  • Harbor - Harbor
  • Quay - Clair
  • Snyk - Snyk
  • vchinnipilli - Kubestriker

Cloud Security Standards

• ISO/IEC 27017:2015
• ISO/IEC 27018:2019
• MTCS SS 584
• CCM
• NIST 800-53

Learning

Blogs

• AWS Security
• Azure Security
• Dark Reading

Courses

• Oracle
  • Oracle Cloud Security Administrator
• A Cloud Guru
  • Learning Paths
    • AWS Security Path
    • Azure Security Path
    • GCP Security Path

Labs

• AWS Workshops
  • AWS Identity: Using Amazon Cognito for serverless consumer apps
  • AWS Network Firewall Workshop
  • AWS Networking Workshop
  • Access Delegation
  • Amazon VPC Endpoint Workshop
  • Build a Vulnerability Management Program Using AWS for AWS
  • Data Discovery and Classification with Amazon Macie
  • Data Protection
  • DevSecOps - Integrating security into your pipeline
  • Disaster Recovery on AWS
  • Finding and addressing Network Misconfigurations on AWS
  • Firewall Manager Service - WAF Policy
  • Getting Hands on with Amazon GuardDuty
  • Hands on Network Firewall Workshop
  • Implementing DDoS Resiliency
  • Infrastructure Identity on AWS
  • Integrating security into your container pipeline
  • Integration, Prioritization, and Response with AWS Security Hub
  • Introduction to WAF
  • Permission boundaries: how to delegate permissions on AWS
  • Protecting workloads on AWS from the instance to the edge
  • Scaling threat detection and response on AWS
  • Serverless Identity
• PagerDuty Training Lab
  • PagerDuty Training GitHub
  • PagerDuty Training for Engineers
  • PagerDuty Training for Everyone: Part 1
  • PagerDuty Training for Everyone: Part 2

Podcasts

• Azure DevOps Podcast
• Cloud Security Podcast by Google
• Security Now

Vulnerable By Design

• CloudGoat by Rhino Security Labs
• ServerlessGoat by OWASP
• WrongSecrets by OWASP

Certifications

• Cloud Vendors
  • AWS Certified Security Specialty
  • Azure Security Engineer Associate
  • Google Professional Cloud Security Engineer
  • Oracle Cloud Platform Identity and Security Management
• ISC² - International Information System Security Certification Consortium
  • CCSP - Certified Cloud Security Professional
• CSA - Cloud Security Alliance
  • CCSK - Certificate of Cloud Security Knowledge
  • CCAK - Certificate of Cloud Auditing Knowledge

Projects

Alerting

• 411 by Etsy
• ElastAlert by Yelp
• StreamAlert by Airbnb

Automated Security Assessment

• Prowler
• CloudFox
• SkyArk
• Pacu
• Bucket Finder
• Boto3
• Principal Mapper
• ScoutSuite
• s3_objects_check
• cloudsplaining
• weirdAAL
• cloudmapper
• NetSPI/AWS_Consoler

Benchmarking

• AWS Security Benchmark

Data Loss Prevention

• Git Secrets by AWS Labs

Firewall Management

• globaldatanet
  • AWS Firewall Factory

Identity and Access Management

• AWS Labs
  • AWS IAM Generator
• Duo Labs
  • Parliament
  • CloudTracker
• Netflix
  • Aardvark
  • ConsoleMe
  • PolicyUniverse
  • Repokid
• Pinterest
  • Knox
• Salesforce
  • Policy Sentry
  • CloudSplaining
  • AWS-AllowLister
  • Terraform for Policy Guru
• welldone.cloud
  • aws-lint-iam-policies
• Misc
  • AWS Missing Tools by CloudAvail
  • Awesome IAM List
  • Enumerate IAM by Andres Riancho
  • Kubernetes AWS IAM Authenticator by Kubernetes SIG

Incident Response

• AWS
  • AWS Incident Response Playbooks by AWS Samples
  • AWS Security Hub Automated Response and Remediation
• Netflix
  • Dispatch by Netflix
• PagerDuty
  • PagerDuty Automated Remediation Docs
  • PagerDuty Business Response Docs
  • PagerDuty DevSecOps Docs
  • PagerDuty Full Case Ownership Docs
  • PagerDuty Full Service Ownership Docs
  • PagerDuty Going OnCall Docs
  • PagerDuty Incident Response Docs
  • PagerDuty Operational Review Docs
  • PagerDuty PostMortem Docs
  • PagerDuty Retrospectives Docs
  • PagerDuty Stakeholder Communication Docs
• Velocidex
  • Velociraptor

Spring

• Spring Cloud Security

Threat modeling

• ThreatModel for Amazon S3 - Library of all the attack scenarios on Amazon S3 and how to mitigate them, following a risk-based approach

Examples

Ex. Automated Security Assessment

• AWS Config Rules Repository
• AWS Inspector Agent Autodeploy
• AWS Inspector Auto Remediation
• AWS Inspector Lambda Finding Processor

Ex. Identity and Access Management

• Amazon Cognito Streams connector for Amazon Redshift

Ex. Logging

• AWS Centralized Logging
• AWS Config Snapshots to ElasticSearch
• AWS CloudWatch Events Monitor Security Groups

Ex. Web Application Firewall

• AWS WAF Sample
• AWS WAF Security Automations

Misc

• Other Awesome Lists
  • Awesome Cloud Cost Control
  • Awesome Cloud Native Security
  • Awesome Cloud Security
  • Awesome IAM List
  • Awesome Incident Response List
  • Awesome Shodan Queries