Cloud-Security-Attacks is a curated index of documented offensive cloud security research across AWS, Azure, and GCP, intended as a study and reference map for authorized pentesters and defenders.
| Tool | JoasASantos/Cloud-Security-Attacks — curated repository of links to documented cloud attack techniques and security tooling for AWS, Azure, and Google Cloud |
| Category | Cloud security research index / offensive security knowledge base |
| Primary Use | Building study paths and engagement checklists for cloud pentests, referencing technique writeups like IAM privilege escalation, Golden SAML, and WAF bypasses in AWS and Azure |
| Safe Use | Educational reference for authorized cloud security assessments, lab environments such as cloudgoat and AzureGoat, and defensive research on hardening own tenant configurations |
| Telemetry Note | The repository itself is a static markdown list and leaves no footprint; the techniques it indexes (e.g., CloudTrail events, Azure AD sign-in anomalies) are what generate observable telemetry in monitored environments |
Cloud-Security-Attacks by JoasASantos is not a piece of executable software but a curated knowledge base — a single README organized as a three-way split across Google Cloud, AWS, and Azure, each section pointing to published research from vendors like Rhino Security Labs, NetSPI, Bishop Fox, Kloudle, Sysdig, and CyberArk. With over a thousand stars and topics tagging cloud-pentesting, redteam, and gcp, the repo has found its niche as a one-stop index for practitioners who need to recall which cloud attack technique has already been publicly documented, by whom, and where the writeup lives. It functions less like a tool and more like a field map of the cloud offensive landscape as accumulated by the research community.
The Google Cloud section is the thinnest, but the entries it does carry are high signal. The first points at Kloudle's analysis of the Cloud Armor 8KB request body inspection limit, a WAF bypass class that recurs across providers because of how managed WAFs truncate body inspection beyond a fixed size. The second covers escalating privileges from an application identity to full cloud access, a trajectory every GCP assessor should internalize: compromise of a service credential, enumeration of its scopes, and pivoting toward IAM bindings that grant broader access. Even with only two entries, the section is a useful reminder that GCP attack surface research is sparser than its AWS counterpart, which shapes what clients and assessors alike tend to overlook.
The AWS section is the heart of the repository, and its organizing logic is instructive. The entries cluster around a handful of recurring themes: WAF and inspection limits, IAM misconfiguration-driven privilege escalation, container and orchestration abuse in ECS, EKS, and Fargate, credential theft and replay, and lateral movement between on-premises identity and the cloud. Rhino Security's work dominates, which is fitting given that shop's outsized contribution to AWS offensive research — from CVE-2022-25165 in the AWS VPN Client to weaponizing ECS task definitions to harvest credentials from running containers.
Several entries deserve particular attention from defenders because they describe behavior that is fully auditable in CloudTrail. The Pillaging ECS Task Definitions writeup, for example, hinges on hardcoded secrets sitting in task definition JSON — meaning the defensive countermeasure is the same artifact the attacker reads: scan your own task definitions for embedded credentials and move them to Secrets Manager or SSM Parameter Store. Similarly, the AWS IAM privilege escalation methods entry from Rhino catalogues policy combinations like iam:PutRolePolicy and sts:AssumeRole chains that defenders can proactively hunt for with tools like PMapper or cloud security posture management products.
The identity-side entries are the most operationally consequential. The Golden SAML references — CyberArk's original research plus Sygnia's detection and hunting companion piece — describe forging SAML assertions by compromising the token-signing certificate, which bypasses MFA entirely and leaves traces primarily in ADFS event logs rather than the target application. Paired with Pass-the-PRT and Pass-the-Certificate entries in the Azure section, these form a coherent module on modern cloud identity attacks where the boundary between on-prem Active Directory and Entra ID (née Azure AD) is the actual attack surface. Any authorized assessment of a hybrid identity environment should treat this cluster as required reading.
The Azure section is broader and leans more toward enumeration and authentication abuse than exploitation of specific CVEs. Account enumeration, subdomain takeover of Azure CDN endpoints, password spraying with detection guidance via Azure Sentinel, illicit consent grant attacks illustrated through 365-Stealer, and MFA bypass via reverse proxies like Evilginx2 — each entry pairs an offensive technique with at least one defensive counterpart in most cases, which is one of the list's quiet strengths. The CloudCopy entry on stealing hashes from domain controllers via cloud-initiated snapshot restore is a classic worth knowing both to execute in labs and to detect via EC2 snapshot and volume attachment events.
The final two sections pivot from techniques to tooling, linking to established repositories that an assessor would actually run. On the AWS side: cloudgoat for deliberately vulnerable scenarios, pacu implicitly via the ECS writeups, my-arsenal-of-aws-security-tools, aws-cloudsaga for event-driven attack simulation, and dafthack's CloudPentestCheatsheets. On the Azure side: MicroBurst's Invoke-EnumerateAzureBlobs.ps1, the AzureAD-Attack-Defense wiki, AzureGoat, azucar, and the Azure Threat Research Matrix. This tail section effectively converts the list from a reading index into the starting point of a toolkit.
For a working professional, the value of Cloud-Security-Attacks is triage. Before an authorized cloud engagement, the list lets you build a technique checklist scoped to the provider in question — confirm the client's WAF posture against the 8KB body-inspection findings, verify RDS enforcement of TLS, review IAM policies against the documented escalation methods, and check whether VPC traffic mirroring permissions are restricted. The list is not a methodology itself, and it contains no code, but it compresses what would otherwise be hours of scattered searching into a single scannable page.
There are limitations worth noting honestly. The repository carries no license declaration, no last-updated metadata per entry, and some links will inevitably rot as vendors reorganize blogs. A handful of entries sit awkwardly — the GKE Kubelet TLS bootstrap piece appears under both Google Cloud and Azure headers, an artifact of manual curation. The list also skews toward research published between roughly 2019 and 2022, so it should be supplemented with current sources for recently shipped services. None of this invalidates it as a study index, but a reader should verify each linked technique against the provider's current documentation before treating it as representative.
Defensively, the repository doubles as a threat model checklist. Every offensive entry implies a control: enforce TLS on RDS, inspect task definitions for secrets, constrain ec2:CreateSnapshot and mirror-related permissions, monitor consent grants and authentication strength in Entra ID, and alert on unusual sts:AssumeRole chains. Blue teams reviewing this list systematically will find it maps almost one-to-one onto a cloud detection engineering backlog, which is arguably the strongest justification for keeping it bookmarked on both sides of the house.
JoasASantos/Cloud-Security-Attacks.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.