CloudJack

CloudJack is a vulnerability assessment utility that identifies subdomain hijacking vulnerabilities in AWS environments resulting from decoupled Route53 and CloudFront configurations. The tool detects two specific vulnerability scenarios: Route53 aliases that reference deleted CloudFront web distributions, and Route53 aliases that point to active CloudFront distributions with deleted CNAMEs. The tool operates by analyzing AWS Route53 hosted zones and CloudFront distributions to identify misconfigurations that could allow attackers to create matching CloudFront distributions or CNAMEs in their own accounts. This exploitation enables attackers to spoof the victim's web site content that would otherwise be accessed through the legitimate account. CloudJack requires AWS IAM credentials with specific permissions for Route53 ListHostedZones, ListResourceRecordSets, and CloudFront ListDistributions actions. The tool integrates with AWS CLI configurations stored in ~/.aws/credentials and supports multiple AWS profiles. It provides output in both text and JSON formats for integration with other security workflows. The utility is implemented in Python and uses the AWS SDK boto3 package. Both Python 2 and Python 3 versions are available. The tool is released under GPL-3.0 license and is available as an open source project on GitHub.