CloudFox
CloudFox helps you gain situational awareness in unfamiliar cloud environments. It’s an open source command line tool created to help penetration testers and other offensive security professionals find exploitable attack paths in cloud infrastructure. CloudFox helps you answer the following common questions (and many more): - What regions is this AWS account using and roughly how many resources are in the account? - What secrets are lurking in EC2 userdata or service specific environment variables? - What workloads have administrative permissions attached? - What actions/permissions does this [principal] have? - What role trusts are overly permissive or allow cross-account assumption? - What endpoints/hostnames/IPs can I attack from an external starting point (public internet)? - What endpoints/hostnames/IPs can I attack from an internal starting point (assumed breach within the VPC)? - What filesystems can I potentially mount from a compromised resource inside the VPC? Demos, Examples, Walkthroughs Blog - Introducing: CloudFox Video - CloudFox + CloudFoxable A Powerful Duo for Mastering the Art of Identifying and Exploiting AWS Attack Paths Video - Penetration Testing with CloudFox
FEATURES
ALTERNATIVES
Managed Kubernetes Inspection Tool leveraging FOSS tools to query and validate security-related settings.
Comprehensive cybersecurity tool for Microsoft Azure providing CSPM & CWPP capabilities.
Cloud security project focusing on discovering and protecting privileged entities in AWS and Azure environments.
A tool to analyze and audit AWS environments for security issues and misconfigurations.
Open-source tool for analyzing AWS temporary tokens to detect malicious activity.
Comprehensive set of security controls for various AWS services to ensure a secure cloud environment.
PINNED
InfoSecHired
An AI-powered career platform that automates the creation of cybersecurity job application materials and provides company-specific insights for job seekers.
Mandos Brief Newsletter
A weekly newsletter providing cybersecurity leadership insights, industry updates, and strategic guidance for security professionals advancing to management positions.
Kriptos
An AI-driven data classification and governance platform that automatically discovers, analyzes, and labels sensitive information while providing risk management and compliance capabilities.
System Two Security
An AI-powered platform that automates threat hunting and analysis by processing cyber threat intelligence and generating customized hunt packages for SOC teams.
Aikido Security
Aikido is an all-in-one security platform that combines multiple security scanning and management functions for cloud-native applications and infrastructure.
Permiso
Permiso is an Identity Threat Detection and Response platform that provides comprehensive visibility and protection for identities across multiple cloud environments.
Wiz
Wiz Cloud Security Platform is a cloud-native security platform that enables security, dev, and devops to work together in a self-service model, detecting and preventing cloud security threats in real-time.
Adversa AI
Adversa AI is a cybersecurity company that provides solutions for securing and hardening machine learning, artificial intelligence, and large language models against adversarial attacks, privacy issues, and safety incidents across various industries.