一键在 Manus 中运行任何 Skill

pentest-cloud

星标5

分支2

更新时间2026年6月9日 03:59

AWS, Azure/Entra ID, and GCP penetration testing. Use when the user mentions AWS pentest, Azure pentest, GCP pentest, IAM privilege escalation, S3 misconfig, IMDSv1/v2 SSRF, managed identity abuse, ScoutSuite, Prowler, Pacu, CloudFox, ROADtools, AzureHound, MicroBurst, AADInternals, Workload Identity, OIDC trust, federated credentials, cross-account / cross-tenant chains, KMS, Lambda, Cognito, App Service, Storage Account, Key Vault, GKE/EKS/AKS, GitHub Actions OIDC trust, Terraform state, or any cloud bucket / IAM enumeration task.

安装

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

在 Manus 中运行

来源

thau0x01

thau0x01/ai-pentest-kb

打开 GitHub 仓库查看创作者相关仓库

下载

在 Manus 中运行

Pentest — Cloud (AWS / Azure / GCP)

Apply 06-cloud/ from the pentest-templates library.

Library root

$PENTEST_LIBRARY — caminho absoluto deste repositório clonado (definido pelo instalador; veja INSTALL.md).

Read 06-cloud/00-overview.md first.

Phase order

AWS

06-cloud/01-aws-recon.md — accounts, IAM inventory, public exposure, IMDS, defensive posture.
06-cloud/02-aws-iam-privesc.md — 30+ documented primitives.
06-cloud/03-aws-services.md — S3, EC2/SSM/IMDS, Lambda, RDS, KMS, Secrets, Cognito, API GW, ECS/EKS.

Azure / Entra ID

06-cloud/04-azure-recon.md — tenant / sub / MG inventory, CA policies, AAD Connect.
06-cloud/05-azure-entra-id.md — app registrations, managed identities, PIM, Conditional Access bypass, PRT theft.
06-cloud/06-azure-services.md — Storage, VMs, AKS, Key Vault, App Service, Logic Apps.

GCP

06-cloud/07-gcp-recon.md — org / folder / project hierarchy, IAM, Workload Identity.
06-cloud/08-gcp-iam-privesc.md — impersonation chains, service-account abuse.
06-cloud/09-gcp-services.md — GCS, GCE, Cloud Functions, Cloud Run, GKE, IAP, Cloud SQL.

Multi-cloud

06-cloud/10-multicloud-cicd.md — GitHub Actions / GitLab / Bitbucket OIDC trust, Terraform state, IaC scanning, container registry abuse.

How to operate

Run a multi-cloud auditor first (Prowler / ScoutSuite / CloudFox) to baseline IAM + public exposure before targeted privesc.
Privesc: walk the documented primitive catalog in 02-aws-iam-privesc.md, 05-azure-entra-id.md, 08-gcp-iam-privesc.md against the discovered identity surface.
CI/CD trust is the most common cross-org pivot — always check OIDC sub claim conditions in trust policies (10-multicloud-cicd.md).
Generate findings via templates/finding-template.md and cross-reference frameworks/cis-benchmarks.md and frameworks/csa-ccm.md.
Hybrid identity (on-prem AD ↔ Entra ID): also pull pentest-active-directory/12-azure-ad-hybrid.md.

When NOT to use

On-prem AD only → pentest-active-directory.
Generic web app hosted in cloud (without cloud-layer findings) → pentest-web-api.

Pre-conditions

Reader/Auditor IAM credentials in account/tenant/project.
ROE clarity on cloud-provider acceptable testing (AWS self-attest, Azure RoE, GCP customer-perspective).
Prowler, ScoutSuite, Pacu, CloudFox, ROADtools, AzureHound, gcphound installed.

OPSEC

CloudTrail / Activity Logs / Audit Logs visible by default.
Privesc primitives often trigger GuardDuty / Defender for Cloud alerts.
Stolen IAM keys often have rotation requirements — coordinate use.

References inside the library

Cheatsheets: cheatsheets/cloud-aws.md, cheatsheets/cloud-azure.md.
Tooling: tools/install-cloud.md, tool-mappings/06-cloud-tools.md.
Frameworks: frameworks/cis-benchmarks.md, frameworks/csa-ccm.md.
Playbook: playbooks/04-cloudgoat-walkthrough.md.

同仓库更多 Skills

同仓库

engagement-management

thau0x01/ai-pentest-kb

Engagement-lifecycle management — pre-engagement scoping, ROE drafting, authorisation letters, threat modeling, CVSS scoring, finding write-up, executive summary, technical report, retest scoping, remediation validation. Use when the user mentions scope a pentest, ROE template, rules of engagement, get-out-of-jail letter, authorisation letter, scope statement, communications plan, blackout window, escalation matrix, threat modeling, STRIDE, PASTA, attack tree, threat actor profile, CVSS scoring, finding template, executive summary, technical report, retest, remediation validation, regression coverage, engagement kickoff, or evidence chain of custody.

2026-06-095

engagement-retest

thau0x01/ai-pentest-kb

Plan and execute a pentest retest — re-scope, re-execute the validation steps from prior findings, detect regressions, and write the retest report. Use when the user mentions retest, re-test, remediation validation, regression coverage, "verify the fixes", "validate remediation", retest scoping, retest report, posture trajectory, or compares "before vs after" findings.

2026-06-095

engagement-scoping

thau0x01/ai-pentest-kb

Drive the pre-engagement scoping conversation and produce the scope statement, Rules of Engagement, authorisation letter, and communications plan. Use when the user mentions kickoff, scoping a pentest, drafting ROE, rules of engagement, scope statement, authorisation letter, get-out-of-jail letter, communications plan, blackout window, escalation matrix, ROE drift, third-party hosting carve-out, social-engineering allowance, time-window restrictions, or evidence-handling rules.

2026-06-095

pentest-active-directory

thau0x01/ai-pentest-kb

Active Directory and hybrid Entra ID penetration testing. Use when the user mentions BloodHound, SharpHound, SOAPHound, AzureHound, RustHound, Kerberoast, AS-REP roast, Golden/Silver/Diamond/Sapphire ticket, DCSync, DCShadow, NTLM relay, ntlmrelayx, ADCS ESC1-ESC15+, EKUwu, Certipy, ACL abuse (GenericAll/WriteDACL/WriteOwner/shadow credentials), GPO abuse, NoPac, ZeroLogon, PetitPotam, DFSCoerce, PrinterBug, krbrelayup, AAD Connect, MSOL_, Pass-Through Auth, Seamless SSO, AdminSDHolder, SID History, krbtgt, or any "domain compromise" task.

2026-06-095

pentest-ai-llm

thau0x01/ai-pentest-kb

LLM-backed application, AI agent, and AI/ML supply-chain penetration testing. Use when the user mentions LLM pentest, AI red team, prompt injection (direct or indirect), jailbreak, DAN, Crescendo, GCG, many-shot jailbreak, system prompt leakage, RAG poisoning, embedding poisoning/inversion, vector DB attack, MCP / Model Context Protocol abuse, tool poisoning, agent excessive agency, function-call abuse, output handling chains (XSS/SSRF/SQLi via LLM output), training-data extraction, membership inference, modelscan/picklescan, Hugging Face poisoned model, garak, PyRIT, promptmap, Augustus, Spikee, OWASP LLM01-LLM10, MITRE ATLAS, or unbounded consumption / cost amplification.

2026-06-095

pentest-cheatsheet

thau0x01/ai-pentest-kb

Surface a one-page pentest cheatsheet for fast field recall. Use when the user asks for a "quick command", "cheatsheet", "one-liner", "what's the syntax for X", "remind me how to do Y", "give me the recon snippets", "AD cheatsheet", "lateral-movement one-liners", "AWS quick commands", "Azure quick commands", "mobile cheatsheet", "initial access cheatsheet", or any request that wants tools/commands without methodology overhead.

2026-06-095

name

pentest-cloud

description

Pentest — Cloud (AWS / Azure / GCP)

Apply 06-cloud/ from the pentest-templates library.

Library root

$PENTEST_LIBRARY — caminho absoluto deste repositório clonado (definido pelo instalador; veja INSTALL.md).

Read 06-cloud/00-overview.md first.

Phase order

AWS

06-cloud/01-aws-recon.md — accounts, IAM inventory, public exposure, IMDS, defensive posture.
06-cloud/02-aws-iam-privesc.md — 30+ documented primitives.
06-cloud/03-aws-services.md — S3, EC2/SSM/IMDS, Lambda, RDS, KMS, Secrets, Cognito, API GW, ECS/EKS.

Azure / Entra ID

06-cloud/04-azure-recon.md — tenant / sub / MG inventory, CA policies, AAD Connect.
06-cloud/05-azure-entra-id.md — app registrations, managed identities, PIM, Conditional Access bypass, PRT theft.
06-cloud/06-azure-services.md — Storage, VMs, AKS, Key Vault, App Service, Logic Apps.

GCP

06-cloud/07-gcp-recon.md — org / folder / project hierarchy, IAM, Workload Identity.
06-cloud/08-gcp-iam-privesc.md — impersonation chains, service-account abuse.
06-cloud/09-gcp-services.md — GCS, GCE, Cloud Functions, Cloud Run, GKE, IAP, Cloud SQL.

Multi-cloud

06-cloud/10-multicloud-cicd.md — GitHub Actions / GitLab / Bitbucket OIDC trust, Terraform state, IaC scanning, container registry abuse.

How to operate

Run a multi-cloud auditor first (Prowler / ScoutSuite / CloudFox) to baseline IAM + public exposure before targeted privesc.
Privesc: walk the documented primitive catalog in 02-aws-iam-privesc.md, 05-azure-entra-id.md, 08-gcp-iam-privesc.md against the discovered identity surface.
CI/CD trust is the most common cross-org pivot — always check OIDC sub claim conditions in trust policies (10-multicloud-cicd.md).
Generate findings via templates/finding-template.md and cross-reference frameworks/cis-benchmarks.md and frameworks/csa-ccm.md.
Hybrid identity (on-prem AD ↔ Entra ID): also pull pentest-active-directory/12-azure-ad-hybrid.md.

When NOT to use

On-prem AD only → pentest-active-directory.
Generic web app hosted in cloud (without cloud-layer findings) → pentest-web-api.

Pre-conditions

Reader/Auditor IAM credentials in account/tenant/project.
ROE clarity on cloud-provider acceptable testing (AWS self-attest, Azure RoE, GCP customer-perspective).
Prowler, ScoutSuite, Pacu, CloudFox, ROADtools, AzureHound, gcphound installed.

OPSEC

CloudTrail / Activity Logs / Audit Logs visible by default.
Privesc primitives often trigger GuardDuty / Defender for Cloud alerts.
Stolen IAM keys often have rotation requirements — coordinate use.

References inside the library

Cheatsheets: cheatsheets/cloud-aws.md, cheatsheets/cloud-azure.md.
Tooling: tools/install-cloud.md, tool-mappings/06-cloud-tools.md.
Frameworks: frameworks/cis-benchmarks.md, frameworks/csa-ccm.md.
Playbook: playbooks/04-cloudgoat-walkthrough.md.