cloud
Cloud exploitation lane — AWS IAM privesc, S3 takeover, k8s RBAC abuse, Terraform state leaks, cloud metadata pivoting.
Best for Cloud penetration testingWorks with GitHubHigh risk
⌘source
- author
@PurpleAILAB- language
- Python
★2.1kstars
366forks
Apr 18, 2026
✦overview.md
Key Features
- ·Enumerates AWS IAM policies for privilege escalation paths
- ·Identifies and exploits dangling S3 buckets for subdomain takeover
- ·Audits Kubernetes RBAC configurations for pod escape and hostPath abuse
- ·Scans exposed Terraform state files for sensitive cloud infrastructure data
- ·Leverages SSRF vulnerabilities to pivot through cloud metadata services
- ·Maps discovered vulnerabilities into attack chains for visualization
Use Cases
- →Security teams conducting authorized penetration tests on cloud environments
- →Red team operators simulating attacker post-exploitation in AWS or Kubernetes
- →DevOps engineers proactively auditing their own infrastructure for misconfigurations
- →Incident responders investigating potential cloud account compromises
Best for
- ✓Cloud penetration testing
- ✓Red team operations
- ✓Security audits
Not ideal for
- !General cloud administration
- !Development workflows
- !Non-security use cases
FAQs
name
cloud-overview
description
Cloud exploitation lane — AWS IAM privesc, S3 takeover, k8s RBAC abuse, Terraform state leaks, cloud metadata pivoting.
Cloud Hunter Skill Catalog
Playbooks
| Skill | Use for |
|---|---|
/skills/cloud/aws-iam-enum/SKILL.md | IAM enumeration + privesc |
/skills/cloud/s3-takeover/SKILL.md | Dangling bucket / subdomain takeover |
/skills/cloud/k8s-pivot/SKILL.md | Pod escape, RBAC abuse, hostPath |
/skills/cloud/terraform-state-leak/SKILL.md | Exposed state file exploitation |
/skills/cloud/imds-pivot/SKILL.md | SSRF → metadata → IAM role |
Workflow (authenticated engagement)
bash("aws sts get-caller-identity")bash("aws iam list-attached-user-policies --user-name <me>")- For each attached policy: fetch JSON and
iam_policy_audit - Feed Terraform state via
bash("aws s3 cp s3://bucket/terraform.tfstate -")→tfstate_audit bash("kubectl get pods -A -o json")→k8s_audit- Every privesc primitive → kg_add_node + chain edges
Workflow (post-SSRF)
metadata_endpoints("aws")for the target cloud- Pivot URL one at a time via the SSRF vector
- Confirmed creds →
credentialnode +leaksedge from the SSRF vuln plan_attack_chains(promote=True)to see the full path
$install
1-click copynpx skills add PurpleAILAB/Decepticon --skill cloudSafety assessment
★
Clarity score
How clear and easy to understand the SKILL.md instructions are, rated from 1 to 5.
4/ 5
very goodClear and well structured, with only minor parts that might need a second read.
◎
Actionability score
How directly an agent can act on the SKILL.md instructions, rated from 1 to 5.
4/ 5
highMostly actionable with clear steps; only a few small gaps remain.