cloud-security
Cloud Security targets identity and access control weaknesses across major cloud platforms. It covers IAM privilege escalation, credential harvesting via metadata SSRF, Entra device-code attacks, GCP service-account impersonation chains, Kubernetes container breakout, and CI/CD federation trust abuse. Includes scripts and references for reconnaissance, exploitation, and lateral movement within cloud environments.
Cloud Security exploits AWS, Azure, and GCP IAM misconfigurations, metadata theft, and container escapes for privilege escalation.
AI-generated summary based on this skill's SKILL.md
Install
hypnguyen1209/offensive-claude/cloud-security · repository language: Python
git clone https://github.com/hypnguyen1209/offensive-claude
cp -r offensive-claude/skills/cloud-security ~/.claude/skills/cloud-securitynpx skillfed install hypnguyen1209/offensive-claude/cloud-securityFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What AWS IAM privilege escalation techniques does Cloud Security cover?
Cloud Security addresses AWS IAM privilege escalation as its highest-weighted intent (0.28). The skill covers misconfigurations in IAM policies that enable attackers to escalate privileges, including cross-account privilege escalation paths and techniques for exploiting overly permissive role assumptions. It provides reconnaissance and exploitation references for identifying and leveraging these weaknesses in AWS environments.
How does Cloud Security help with IMDS metadata SSRF credential theft?
Cloud Security treats credential harvesting via SSRF and metadata endpoints as a core focus (0.24 weight). The skill documents how attackers exploit Server-Side Request Forgery to access cloud metadata services—such as AWS IMDS, Azure metadata endpoints, and GCP metadata servers—to steal temporary credentials and service account tokens for lateral movement and privilege escalation.
What container security assessment capabilities does Cloud Security provide?
Cloud Security includes assessment of Kubernetes and container security for breakout paths (0.2 weight). It covers container escape exploits, EKS node credential lateral movement, and Kubernetes RBAC privilege escalation techniques. The skill helps identify misconfigurations that allow attackers to break out of containers and move laterally within Kubernetes clusters.
Does Cloud Security address CI/CD and IaC federation trust abuse?
Yes. Cloud Security covers abuse of CI/CD and Infrastructure-as-Code federation trust policies (0.18 weight), including OIDC federation trust exploitation and Terraform state secrets extraction. It documents how attackers can abuse trust relationships between CI/CD systems and cloud identity providers to gain unauthorized access and escalate privileges.
What cloud platforms does Cloud Security red team assessment cover?
Cloud Security performs red team assessments across AWS, Azure, and GCP (0.1 weight). It includes Azure Entra device-code phishing attacks, GCP service account impersonation chains and actAs attacks, and Azure managed identity escalation. The skill provides cross-platform reconnaissance and exploitation guidance for comprehensive cloud security testing.
What license does Cloud Security use?
Cloud Security is released under the MIT license, allowing broad use, modification, and distribution for both commercial and non-commercial purposes.
SKILL.md
rendered from the published skill — quoted content, verbatim
name: cloud-security description: Use when attacking AWS/Azure/GCP cloud — IAM/identity privilege escalation, IMDS/metadata SSRF, Entra device-code & PRT theft, GCP impersonation chains, Kubernetes/container escape, IaC/CI-CD federation abuse metadata: type: offensive phase: exploitation tools: pacu, cloudfox, scoutsuite, prowler, trivy, kubectl, aws-cli, az-cli, gcloud, peirates, mkat, azurehound, roadtools, stratus-red-team, kube-bench mitre: [T1078.004, T1552.005, T1098.001, T1528, T1611, T1548] kill_chain: phase: [recon, exploit] step: [1, 4] attck_tactics: [TA0043, TA0001, TA0004, TA0008, TA0006] attck_techniques: [T1078.004, T1552.005, T1552.007, T1098.001, T1098.003, T1528, T1606.002, T1611, T1610, T1134.001, T1548, T1538] depends_on: [recon-osint] feeds_into: [exploit-development, active-directory-attack, advanced-redteam] inputs: [cloud_config, iam_policies, kubeconfig, ci_cd_config] outputs: [cloud_misconfig_list, finding_record, attack_path, stolen_credentials] references: - references/aws-iam-privesc.md - references/imds-metadata-ssrf.md - references/azure-entra-attacks.md - references/gcp-attacks.md -
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 13 files
skills/cloud-security/SKILL.md
skills/cloud-security/references/aws-iam-privesc.md
skills/cloud-security/references/azure-entra-attacks.md
skills/cloud-security/references/gcp-attacks.md
skills/cloud-security/references/iac-secrets-ci-cd.md
skills/cloud-security/references/imds-metadata-ssrf.md
skills/cloud-security/references/kubernetes-container-escape.md
skills/cloud-security/scripts/aws_privesc_enum.py
skills/cloud-security/scripts/entra_device_code_phish.py
skills/cloud-security/scripts/gcp_impersonation_mapper.py
skills/cloud-security/scripts/imds_harvester.py
skills/cloud-security/scripts/k8s_can_i_abuse.py
skills/cloud-security/scripts/oidc_trust_auditor.py