cloud

Stars9

Forks0

UpdatedJune 8, 2026 at 15:21

Cloud exploitation lane — AWS IAM privesc, S3 takeover, k8s RBAC abuse, Terraform state leaks, cloud metadata pivoting.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Source

MingyiSecLab

MingyiSecLab/Mingyi-Atlas

View GitHub Repository View Creator Repositories

Download

Related occupationsSOC

Based on SOC occupation classification

Computer Occupations, All OtherComputer and Mathematical Occupations·SOC 15-1299

File Explorer

14 files

SKILL.md

readonly

name	cloud
description	Cloud exploitation lane — AWS IAM privesc, S3 takeover, k8s RBAC abuse, Terraform state leaks, cloud metadata pivoting.

Cloud Hunter Skill Catalog

Playbooks

Skill	Use for
`/skills/standard/cloud/aws-iam-enum/SKILL.md`	IAM enumeration + privesc
`/skills/standard/cloud/s3-takeover/SKILL.md`	Dangling bucket / subdomain takeover
`/skills/standard/cloud/k8s-pivot/SKILL.md`	Pod escape, RBAC abuse, hostPath
`/skills/standard/cloud/terraform-state-leak/SKILL.md`	Exposed state file exploitation
`/skills/standard/cloud/imds-pivot/SKILL.md`	SSRF → metadata → IAM role

Workflow (authenticated engagement)

bash("aws sts get-caller-identity")
bash("aws iam list-attached-user-policies --user-name <me>")
For each attached policy: fetch JSON and iam_policy_audit
Feed Terraform state via bash("aws s3 cp s3://bucket/terraform.tfstate -") → tfstate_audit
bash("kubectl get pods -A -o json") → k8s_audit
Every privesc primitive → kg_add_node + chain edges

Workflow (post-SSRF)

metadata_endpoints("aws") for the target cloud
Pivot URL one at a time via the SSRF vector
Confirmed creds → credential node + leaks edge from the SSRF vuln
plan_attack_chains(promote=True) to see the full path

More from this repository

same repository

benchmark

MingyiSecLab/Mingyi-Atlas

Benchmark mode marker — engagement objective is flag capture. Generic engagement rules apply unchanged.

2026-06-089

adcs-esc1

MingyiSecLab/Mingyi-Atlas

Exploit Active Directory Certificate Services ESC1 — vulnerable template allows arbitrary SAN, enabling user impersonation up to domain admin.

2026-06-089

bloodhound-query

MingyiSecLab/Mingyi-Atlas

BloodHound ingestion + canonical Cypher queries for AD attack-path enumeration. Run after collector dumps zip; promotes findings into the knowledge graph.

2026-06-089

netexec

MingyiSecLab/Mingyi-Atlas

NetExec (CrackMapExec successor) — unified SMB/LDAP/MSSQL/WinRM/RDP/SSH/FTP/VNC protocol auth + post-auth modules. 200+ modules incl. BloodHound auto-ingest, ESC1-15 scanning, PrintNightmare, LDAP relay.

2026-06-089

MingyiSecLab/Mingyi-Atlas

Active Directory attack lane — BloodHound ingestion, Kerberoasting, ADCS ESC scanning, DCSync, LAPS extraction.

2026-06-089

engagement-lifecycle

MingyiSecLab/Mingyi-Atlas

Red team engagement lifecycle management — initiation, phase transitions, go/no-go gates, deconfliction, emergency procedures, completion.

2026-06-089

name	cloud
description	Cloud exploitation lane — AWS IAM privesc, S3 takeover, k8s RBAC abuse, Terraform state leaks, cloud metadata pivoting.

Cloud Hunter Skill Catalog

Playbooks

Skill	Use for
`/skills/standard/cloud/aws-iam-enum/SKILL.md`	IAM enumeration + privesc
`/skills/standard/cloud/s3-takeover/SKILL.md`	Dangling bucket / subdomain takeover
`/skills/standard/cloud/k8s-pivot/SKILL.md`	Pod escape, RBAC abuse, hostPath
`/skills/standard/cloud/terraform-state-leak/SKILL.md`	Exposed state file exploitation
`/skills/standard/cloud/imds-pivot/SKILL.md`	SSRF → metadata → IAM role

Workflow (authenticated engagement)

bash("aws sts get-caller-identity")
bash("aws iam list-attached-user-policies --user-name <me>")
For each attached policy: fetch JSON and iam_policy_audit
Feed Terraform state via bash("aws s3 cp s3://bucket/terraform.tfstate -") → tfstate_audit
bash("kubectl get pods -A -o json") → k8s_audit
Every privesc primitive → kg_add_node + chain edges

Workflow (post-SSRF)

metadata_endpoints("aws") for the target cloud
Pivot URL one at a time via the SSRF vector
Confirmed creds → credential node + leaks edge from the SSRF vuln
plan_attack_chains(promote=True) to see the full path