Breaking and Pwning Apps and Servers on AWS and Azure
Amazon Web Services (AWS) and Azure run the most popular and used cloud infrastructure and boutique of services. There is a need for security testers, Cloud/IT admins and people tasked with the role of DevSecOps to learn on how to effectively attack and test their cloud infrastructure. In this tools and techniques based training we cover attack approaches, creating your attack arsenal in the cloud. This training is designed to help you learn how to test and attack cloud infrastructure, including AWS and Azure, using various tools and techniques. The training includes: * Hands-on labs and exercises to help you practice your skills * Real-world scenarios and case studies to help you understand how to apply your skills in real-world situations * A comprehensive guide to cloud security testing and penetration testing This training is perfect for anyone who wants to learn how to test and attack cloud infrastructure, including security testers, Cloud/IT admins, and people tasked with the role of DevSecOps.
FEATURES
ALTERNATIVES
Automatically compile AWS SCPs for compliant AWS services based on preferred frameworks.
Nuvola is a tool for security analysis on AWS environments with a focus on creating a digital twin of cloud platforms.
Zeus is a powerful tool for AWS EC2 / S3 / CloudTrail / CloudWatch / KMS best hardening practices with a focus on Identity and Access Management.
An open-source security tool for AWS, Azure, Google Cloud, and Kubernetes security assessments and audits.
A command line tool that counts Amazon resources across regions and displays the results in a friendly format.
An AWS resource policy security checkup tool that identifies public, external account access, intra-org account access, and private resources.
Analyzes CloudTrail data of a given AWS account and generates a summary of recently active IAM principals, API calls they made, as well as regions, IP addresses and user agents they used.
A multi-threaded AWS security-focused inventory collection tool with comprehensive resource coverage and efficient data collection methods.
PINNED
Mandos Brief Newsletter
A weekly newsletter providing cybersecurity leadership insights, industry updates, and strategic guidance for security professionals advancing to management positions.
OSINTLeak
OSINTLeak is a tool for discovering and analyzing leaked sensitive information across various online sources to identify potential security risks.
ImmuniWeb® Discovery
ImmuniWeb Discovery is an attack surface management platform that continuously monitors an organization's external digital assets for security vulnerabilities, misconfigurations, and threats across domains, applications, cloud resources, and the dark web.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.