AWS pentesting — IAM privilege escalation, S3 misconfigs, Lambda abuse, EC2 SSRF.
Official PageOfficial AWS CLI
pip3 install awscliaws sts get-caller-identity; aws iam list-usersAWS situational awareness
go install github.com/BishopFox/cloudfox@latestcloudfox aws all-checks --profile pentestIAM permission bruteforcer
git clone https://github.com/andresriancho/enumerate-iampython3 enumerate-iam.py --access-key AKIA... --secret-key ...AWS exploitation framework
git clone https://github.com/RhinoSecurityLabs/pacupython3 pacu.py; run iam__enum_permissionsIAM privilege escalation path finder
pip3 install principalmapperpmapper --profile pentest graph create; pmapper query "who can do iam:CreateRole"S3 bucket scanner
pip3 install s3scanners3scanner scan --buckets-file buckets.txtAWS attack library
git clone https://github.com/carnal0wnage/weirdAALpython3 weirdAAL.py -m ec2_describe_all -t pentestAWS security audit
pip3 install scoutsuitescout aws --profile default