This is an offensive guide to securing AWS infrastructures. The hope is that by knowing how to take advantage of various types of AWS weaknesses you will be verse enough to provide the correct countermeasures.
☆174Mar 1, 2019Updated 7 years ago
Alternatives and similar repositories for guide-aws-hacking
Users that are interested in guide-aws-hacking are comparing it to the libraries listed below
Sorting:
- Repository for all the workshop content delivered at nullcon X on 1st of March 2019☆80Apr 4, 2019Updated 6 years ago
- Proof-of-Concept exploit of CVE-2018-19131: Squid Proxy XSS via X.509 Certificate☆19Nov 14, 2018Updated 7 years ago
- A utility to convert your AWS CLI credentials into AWS console access.☆256May 7, 2020Updated 5 years ago
- Defending IaaS with ATT&CK is a project to create a collection of ATT&CK techniques relevant to a Linux IaaS environment, as well as a me…☆14May 28, 2025Updated 9 months ago
- Some python scripts I wrote that help with various specialized AWS security things☆10Jan 15, 2020Updated 6 years ago
- A collection of Metasploit plugins I have written for various reasons.☆15Dec 5, 2020Updated 5 years ago
- A very vulnerable serverless application in AWS Lambda☆98Oct 7, 2019Updated 6 years ago
- Packer and vagrant scripts to automate building Windows and Linux machines on vCenter☆17Jul 7, 2019Updated 6 years ago
- Opsec considerations for each AWS GuardDuty finding type.☆23Oct 29, 2020Updated 5 years ago
- A collection of AWS penetration testing junk☆1,220Aug 30, 2023Updated 2 years ago
- The Open-Source AWS Cyber Range☆492Aug 16, 2020Updated 5 years ago
- TSLint rules for Angular☆18Nov 30, 2018Updated 7 years ago
- An AWS Pentesting tool that lets you use one-liner commands to backdoor an AWS account's resources with a rogue AWS account - or share th…☆14Feb 16, 2021Updated 5 years ago
- A BurpSuite extension for beautifying .NET message parameters and hiding some of the extra clutter that comes with .NET web apps (i.e. __…☆12Jun 29, 2015Updated 10 years ago
- ☆261Jun 28, 2024Updated last year
- Ruby command-line interface to Burp Suite's REST API☆58Apr 1, 2020Updated 5 years ago
- Cloudformation Template and Lambda to detect if Instance Profile credentials are being used outside your AWS Account.☆29Aug 18, 2019Updated 6 years ago
- Burp extension to generate multi-step CSRF POC.☆31Sep 23, 2019Updated 6 years ago
- Damn Vulnerable Cloud Application☆208Sep 12, 2018Updated 7 years ago
- CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool☆3,487Feb 12, 2026Updated 2 weeks ago
- POC for .NET mssql client for accessing database data through beacon☆64Sep 12, 2023Updated 2 years ago
- C# port of LogServiceCrash☆46Oct 7, 2020Updated 5 years ago
- An AWS Lambda vulnerable application written in flask.☆49Oct 9, 2017Updated 8 years ago
- Intentionally Vulnerable Serverless Functions to understand the specifics of Serverless Security Vulnerabilities☆136Dec 8, 2022Updated 3 years ago
- Proof-of-Concept Dictionary Attacker against IKEv1 PSK in Main Mode☆18Nov 28, 2019Updated 6 years ago
- ☆18Sep 22, 2018Updated 7 years ago
- Welcome to OpenDevSecOps! Our mission is to deliver highly-resilient, readily-available and free defensive and offensive devops security …☆21Jan 29, 2019Updated 7 years ago
- Resource types that can be publicly exposed on AWS☆331Feb 23, 2022Updated 4 years ago
- splunk_pentest_app☆50Apr 22, 2016Updated 9 years ago
- ☆28Oct 16, 2017Updated 8 years ago
- Reproducible and extensible BloodHound playbooks☆44Jan 20, 2020Updated 6 years ago
- Pown.js is a security testing an exploitation toolkit built on top of Node.js and NPM.☆261Apr 7, 2023Updated 2 years ago
- a CLI for ephemeral penetration testing☆16Dec 10, 2019Updated 6 years ago
- The AWS exploitation framework, designed for testing the security of Amazon Web Services environments.☆5,073Updated this week
- ☆16Apr 17, 2021Updated 4 years ago
- Exploits for some of the vulnerabilities I have discovered☆19Aug 3, 2020Updated 5 years ago
- Use Terraform to create your own vulnerable by design AWS IAM privilege escalation playground.☆550Sep 11, 2025Updated 5 months ago
- A collection of useful Serverless functions I use when pentesting☆391Dec 9, 2022Updated 3 years ago
- Post-exploitation tool collects data going out and coming into the browser and makes use of it.☆23Apr 22, 2022Updated 3 years ago