akde/infosec

Click Here

  • Pacu — AWS exploitation framework

    Pacu can be used to test an AWS account. Setup: Unauthorized enumeration Requires only an AWS access key and secret key. Enu­mer­ate roles. Cre­ate a list with pos­si­ble roles to check. run iam__enum_roles --word-list /tmp/roles.txt --account-id $accountId Enu­mer­ate users which belong to a (pre­vi­ous­ly found) role. Cre­ate also a list of pos­si­ble user names. run iam__enum_users --word-list…

  • Cloud Enumeration

    Initial (network) enumeration Check where a ser­vice is host­ed by quer­ing the name­serv­er records for our tar­get domain: host -t ns $domain Get more infor­ma­tion / con­fir­ma­tion via a whois query to one pre­vi­ous­ly found domain. whois $previouslyFoundDomain Check where a host is running: host $domainhost $ipFromTheDomain Check more domains of this organ­i­sa­tion / of…

  • AWS Amazon Web Service enumeration

    Use pro­files: See https://github.com/eon01/AWS-CheatSheet for many com­mands or https://swisskyrepo.github.io/InternalAllTheThings/cloud/aws/aws-access-token/ General Get Infos of the cur­rent used profile aws [--profile $profile] sts get-caller-identity Anoth­er pos­si­bil­i­ty to gain an ARN (with account id) is to call a non-exist­ing func­tion and to extract data from the error message. EC2 List all EC2 images = AMI’s: aws [--profile $profile] ec2…