cloud

Estrelas9

Forks0

Atualizado8 de junho de 2026 às 15:21

Cloud exploitation lane — AWS IAM privesc, S3 takeover, k8s RBAC abuse, Terraform state leaks, cloud metadata pivoting.

Instalação

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Fonte

MingyiSecLab

MingyiSecLab/Mingyi-Atlas

Abrir repositório GitHub Ver repositórios do creator

Download

Ocupações relacionadasSOC

Baseado na classificação ocupacional SOC

Outras ocupações de informáticaInformática e Matemática·SOC 15-1299

Explorador de arquivos

14 arquivos

SKILL.md

readonly

name	cloud
description	Cloud exploitation lane — AWS IAM privesc, S3 takeover, k8s RBAC abuse, Terraform state leaks, cloud metadata pivoting.

Cloud Hunter Skill Catalog

Playbooks

Skill	Use for
`/skills/standard/cloud/aws-iam-enum/SKILL.md`	IAM enumeration + privesc
`/skills/standard/cloud/s3-takeover/SKILL.md`	Dangling bucket / subdomain takeover
`/skills/standard/cloud/k8s-pivot/SKILL.md`	Pod escape, RBAC abuse, hostPath
`/skills/standard/cloud/terraform-state-leak/SKILL.md`	Exposed state file exploitation
`/skills/standard/cloud/imds-pivot/SKILL.md`	SSRF → metadata → IAM role

Workflow (authenticated engagement)

bash("aws sts get-caller-identity")
bash("aws iam list-attached-user-policies --user-name <me>")
For each attached policy: fetch JSON and iam_policy_audit
Feed Terraform state via bash("aws s3 cp s3://bucket/terraform.tfstate -") → tfstate_audit
bash("kubectl get pods -A -o json") → k8s_audit
Every privesc primitive → kg_add_node + chain edges

Workflow (post-SSRF)

metadata_endpoints("aws") for the target cloud
Pivot URL one at a time via the SSRF vector
Confirmed creds → credential node + leaks edge from the SSRF vuln
plan_attack_chains(promote=True) to see the full path

Mais deste repositório

mesmo repositório

benchmark

MingyiSecLab/Mingyi-Atlas

Benchmark mode marker — engagement objective is flag capture. Generic engagement rules apply unchanged.

2026-06-089

adcs-esc1

MingyiSecLab/Mingyi-Atlas

Exploit Active Directory Certificate Services ESC1 — vulnerable template allows arbitrary SAN, enabling user impersonation up to domain admin.

2026-06-089

bloodhound-query

MingyiSecLab/Mingyi-Atlas

BloodHound ingestion + canonical Cypher queries for AD attack-path enumeration. Run after collector dumps zip; promotes findings into the knowledge graph.

2026-06-089

netexec

MingyiSecLab/Mingyi-Atlas

NetExec (CrackMapExec successor) — unified SMB/LDAP/MSSQL/WinRM/RDP/SSH/FTP/VNC protocol auth + post-auth modules. 200+ modules incl. BloodHound auto-ingest, ESC1-15 scanning, PrintNightmare, LDAP relay.

2026-06-089

MingyiSecLab/Mingyi-Atlas

Active Directory attack lane — BloodHound ingestion, Kerberoasting, ADCS ESC scanning, DCSync, LAPS extraction.

2026-06-089

engagement-lifecycle

MingyiSecLab/Mingyi-Atlas

Red team engagement lifecycle management — initiation, phase transitions, go/no-go gates, deconfliction, emergency procedures, completion.

2026-06-089

name	cloud
description	Cloud exploitation lane — AWS IAM privesc, S3 takeover, k8s RBAC abuse, Terraform state leaks, cloud metadata pivoting.

Cloud Hunter Skill Catalog

Playbooks

Skill	Use for
`/skills/standard/cloud/aws-iam-enum/SKILL.md`	IAM enumeration + privesc
`/skills/standard/cloud/s3-takeover/SKILL.md`	Dangling bucket / subdomain takeover
`/skills/standard/cloud/k8s-pivot/SKILL.md`	Pod escape, RBAC abuse, hostPath
`/skills/standard/cloud/terraform-state-leak/SKILL.md`	Exposed state file exploitation
`/skills/standard/cloud/imds-pivot/SKILL.md`	SSRF → metadata → IAM role

Workflow (authenticated engagement)

bash("aws sts get-caller-identity")
bash("aws iam list-attached-user-policies --user-name <me>")
For each attached policy: fetch JSON and iam_policy_audit
Feed Terraform state via bash("aws s3 cp s3://bucket/terraform.tfstate -") → tfstate_audit
bash("kubectl get pods -A -o json") → k8s_audit
Every privesc primitive → kg_add_node + chain edges

Workflow (post-SSRF)

metadata_endpoints("aws") for the target cloud
Pivot URL one at a time via the SSRF vector
Confirmed creds → credential node + leaks edge from the SSRF vuln
plan_attack_chains(promote=True) to see the full path