an0nym0us3r Goto Github PK

amass

In-depth Attack Surface Mapping and Asset Discovery

api-gateway-secure-pet-store

Amazon API Gateway sample using Amazon Cognito credentials through AWS Lambda

api_wordlist

A wordlist of API names for web application assessments

aquatone

A Tool for Domain Flyovers

attacking-cloudgoat2

A step-by-step walkthrough of CloudGoat 2.0 scenarios.

awesome-google-vrp-writeups

🐛 A list of writeups from the Google VRP Bug Bounty program

awesome-k8s-security

A curated list for Awesome Kubernetes Security resources

awesome-waf

🔥 Everything about web-application firewalls (WAF).

aws-audit

AWS Audit Scripts - CloudFront subdomain takeover audit, etc

aws-iam-permissions-scanner

AWS IAM User Permissions

aws-incident-response-playbooks

aws-waf-ipset-auto-update-aws-ip-ranges

This project creates two regional WAF IP sets and automatically updates them with AWS service's IP ranges from the ip-ranges.json file. The ranges are configurable as well as the regions for EC2 ranges. Use cases include allowing CloudFront requests, Route53 health checker and EC2 IP range (which includes AWS Lambda and CloudWatch Synthetics).

aws_pwn

A collection of AWS penetration testing junk

big-list-of-naughty-strings

The Big List of Naughty Strings is a list of strings which have a high probability of causing issues when used as user-input data.

can-i-take-over-xyz

"Can I take over XYZ?" — a list of services and how to claim (sub)domains with dangling DNS records.

cliam

cloudjack

Route53/CloudFront Vulnerability Assessment Utility

cloudsplaining

Cloudsplaining is an AWS IAM Security Assessment tool that identifies violations of least privilege and generates a risk-prioritized report.

dnsx

dnsx is a fast and multi-purpose DNS toolkit allow to run multiple DNS queries of your choice with a list of user-supplied resolvers.

domain-protect

Protect against subdomain takeover

dvsa

a Damn Vulnerable Serverless Application

enumerate-iam

Enumerate the permissions associated with AWS credential set

eyewitness

EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible.

feroxbuster

A fast, simple, recursive content discovery tool written in Rust.

ffuf

Fast web fuzzer written in Go

gau

Fetch known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl.

hakrawler

Simple, fast web crawler designed for easy, quick discovery of endpoints and assets within a web application

httprobe

Take a list of domains and probe for working HTTP and HTTPS servers

iam-vulnerable

Use Terraform to create your own vulnerable by design AWS IAM privilege escalation playground.

iamfinder

IAMFinder enumerates and finds users and IAM roles in a target AWS account.