메뉴
Perform comprehensive security posture assessment of AWS accounts using ScoutSuite to enumerate resources, identify misconfigurations, and generate actionable security reports.
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/xalgord/xalgorix --skill performing-aws-account-enumeration-with-scout-suite명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
SKILL.md 표시 중
Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.
Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.
Identifying and exploiting dangling DNS records pointing to unclaimed cloud services, enabling subdomain takeover for phishing, cookie stealing, and authentication bypass during authorized penetration tests.
SOC 직업 분류 기준
| name | performing-aws-account-enumeration-with-scout-suite |
| description | Perform comprehensive security posture assessment of AWS accounts using ScoutSuite to enumerate resources, identify misconfigurations, and generate actionable security reports. |
| domain | cybersecurity |
| subdomain | cloud-security |
| tags | ["aws","scoutsuite","cloud-security","enumeration","misconfiguration","security-audit","cspm","nccgroup"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"] |
ScoutSuite is an open-source multi-cloud security auditing tool developed by NCC Group that enables comprehensive security posture assessment of AWS environments. It queries AWS APIs to gather configuration data across all services, stores results locally, and generates interactive HTML reports highlighting high-risk areas. ScoutSuite is agentless and works by analyzing how cloud resources are configured, accessed, and monitored.
AccessDenied/UnauthorizedOperation before trusting a "good" result - missing iam:GenerateCredentialReport or s3:GetBucketPolicy produces false greens.--regions us-east-1 misses opt-in regions and resources elsewhere. Run a full scout aws (all regions) at least once; remember IAM/S3 are global and surface under any region.cloudfox env-vars or manual aws ssm describe-parameters.aws s3api get-public-access-block (account and bucket) before concluding.--profile); one clean account says nothing about the others.scoutsuite-results/scoutsuite_results.json and look for flagged_items > 0 with level: "danger" (e.g., iam-root-no-mfa, s3-bucket-world-listable), then reproduce it with the matching CLI call.awsAccessDenied in the log, validated danger findings via direct API calls, and scanned every account in the org.pip install scoutsuite
scout --version
aws configure
# Or use environment variables:
export AWS_ACCESS_KEY_ID=<your-key>
export AWS_SECRET_ACCESS_KEY=<your-secret>
export AWS_DEFAULT_REGION=us-east-1
Attach the AWS managed policy SecurityAudit and ViewOnlyAccess to the IAM user or role running ScoutSuite. For comprehensive scanning, a custom policy may be needed:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"acm:Describe*",
"acm:List*",
"cloudformation:Describe*",
"cloudformation:Get*",
"cloudformation:List*",
"cloudtrail:Describe*",
"cloudtrail:Get*",
"cloudtrail:List*",
"cloudwatch:Describe*",
"cloudwatch:Get*",
"cloudwatch:List*",
"config:Describe*",
"config:Get*",
"config:List*",
"dynamodb:Describe*",
"dynamodb:List*",
"ec2:Describe*",
"ec2:Get*",
"elasticloadbalancing:Describe*",
"iam:Generate*",
"iam:Get*",
"iam:List*",
"iam:Simulate*",
"kms:Describe*",
"kms:Get*",
"kms:List*",
"lambda:Get*",
"lambda:List*",
"logs:Describe*",
"logs:Get*",
"rds:Describe*",
"rds:List*",
"redshift:Describe*",
"route53:Get*",
"route53:List*",
"s3:Get*",
"s3:List*",
"ses:Get*",
"ses:List*",
"sns:Get*",
"sns:List*",
"sqs:Get*",
"sqs:List*",
"ssm:Describe*",
"ssm:Get*",
"ssm:List*"
],
"Resource": "*"
}
]
}
scout aws
scout aws --services s3 iam ec2 rds
scout aws --regions us-east-1 us-west-2 eu-west-1
scout aws --profile target-account-profile
scout aws --skip iam ec2
scout aws --report-dir /tmp/scoutsuite-reports/
ScoutSuite generates an interactive HTML report stored locally. The report includes:
| Service | Critical Checks |
|---|---|
| IAM | Root account MFA, password policy, unused credentials, overprivileged policies |
| S3 | Public buckets, unencrypted buckets, versioning disabled, logging disabled |
| EC2 | Security groups with 0.0.0.0/0, unencrypted EBS volumes, public IPs |
| RDS | Public accessibility, unencrypted databases, backup retention |
| CloudTrail | Logging disabled, log file validation, multi-region disabled |
| Lambda | Public access, environment variable secrets, VPC configuration |
# Run ScoutSuite in CI/CD pipeline and fail on danger findings
scout aws --services s3 iam ec2 --no-browser --report-dir ./scout-report/
# Parse results programmatically
python -c "
import json
with open('./scout-report/scoutsuite-results/scoutsuite_results.json') as f:
results = json.load(f)
for service in results.get('services', {}):
findings = results['services'][service].get('findings', {})
for finding_id, finding in findings.items():
if finding.get('flagged_items', 0) > 0 and finding.get('level') == 'danger':
print(f'CRITICAL: {finding_id} - {finding.get(\"description\", \"\")}')
"
ScoutSuite supports multiple cloud providers using the same framework:
# Azure
scout azure --cli
# GCP
scout gcp --user-account
# AWS with specific profile
scout aws --profile production