Enrich Cloud Infrastructure tool metadata (THE-133)

Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
s0lray
2026-03-28 13:35:17 -04:00
co-authored by Paperclip
parent 8b7d86e178
commit 6b106e973f
+377 -62
View File
@@ -4028,20 +4028,65 @@
"name": "AWS Enumeration",
"type": "folder",
"children": [
{
"name": "cloud_enum (T)",
"type": "url",
"url": "https://github.com/initstring/cloud_enum"
},
{
"name": "AWSBucketDump (T)",
"type": "url",
"url": "https://github.com/jordanpotti/AWSBucketDump"
"url": "https://github.com/jordanpotti/AWSBucketDump",
"description": "Python tool that enumerates AWS S3 buckets and optionally downloads accessible objects using keyword and pattern-based discovery.",
"status": "live",
"pricing": "free",
"bestFor": "Targeted S3 bucket discovery and object collection",
"input": "AWS account naming patterns, keywords, and optional wordlists",
"output": "Discovered bucket names and downloadable object listings/files",
"opsec": "active",
"opsecNote": "Actively sends requests to S3 endpoints and can download objects.",
"localInstall": true,
"googleDork": false,
"registration": false,
"editUrl": false,
"api": false,
"invitationOnly": false,
"deprecated": false
},
{
"name": "cloud_enum (T)",
"type": "url",
"url": "https://github.com/initstring/cloud_enum",
"description": "Multi-cloud enumeration tool that looks for exposed AWS, Azure, and GCP storage assets from target naming patterns.",
"status": "live",
"pricing": "free",
"bestFor": "Rapid discovery of cloud storage exposure across major providers",
"input": "Company names, domains, and custom keywords/wordlists",
"output": "Potentially exposed cloud storage resources by provider",
"opsec": "active",
"opsecNote": "Performs direct enumeration requests against cloud provider endpoints.",
"localInstall": true,
"googleDork": false,
"registration": false,
"editUrl": false,
"api": false,
"invitationOnly": false,
"deprecated": false
},
{
"name": "Subfinder (T)",
"type": "url",
"url": "https://github.com/projectdiscovery/subfinder"
"url": "https://github.com/projectdiscovery/subfinder",
"description": "Fast passive subdomain discovery utility that aggregates results from many curated OSINT and API-backed sources.",
"status": "live",
"pricing": "free",
"bestFor": "Passive subdomain enumeration for cloud asset inventorying",
"input": "Domain name and optional API credentials for data sources",
"output": "Resolved and unresolved subdomain candidates",
"opsec": "passive",
"opsecNote": "Uses third-party data sources by default and avoids active probing unless paired with other tools.",
"localInstall": true,
"googleDork": false,
"registration": true,
"editUrl": false,
"api": true,
"invitationOnly": false,
"deprecated": false
}
]
},
@@ -4049,30 +4094,105 @@
"name": "Azure/GCP Discovery",
"type": "folder",
"children": [
{
"name": "GCPBucketBrute (T)",
"type": "url",
"url": "https://github.com/RhinoSecurityLabs/GCPBucketBrute"
},
{
"name": "AADInternals (T)",
"type": "url",
"url": "https://github.com/Gerenios/AADInternals"
"url": "https://github.com/Gerenios/AADInternals",
"description": "PowerShell toolkit for Azure AD and Entra ID assessment, including tenant reconnaissance and hybrid identity attack-path analysis.",
"status": "live",
"pricing": "free",
"bestFor": "Deep Azure AD reconnaissance and security assessment",
"input": "Tenant identifiers, domain names, and account context",
"output": "Tenant/user intelligence, configuration findings, and attack-path indicators",
"opsec": "active",
"opsecNote": "Queries Microsoft identity services directly and may generate tenant-visible activity.",
"localInstall": true,
"googleDork": false,
"registration": false,
"editUrl": false,
"api": false,
"invitationOnly": false,
"deprecated": false
},
{
"name": "ROADtools (T)",
"name": "GCPBucketBrute (T)",
"type": "url",
"url": "https://github.com/dirkjanm/roadtools"
"url": "https://github.com/RhinoSecurityLabs/GCPBucketBrute",
"description": "Google Cloud Storage bucket enumeration utility for identifying publicly accessible or weakly protected buckets.",
"status": "live",
"pricing": "free",
"bestFor": "Enumerating likely GCS bucket names at scale",
"input": "Target company names, domains, and custom wordlists",
"output": "Valid bucket names with access status and findings",
"opsec": "active",
"opsecNote": "Performs direct requests against GCS endpoints and can be detected in provider logs.",
"localInstall": true,
"googleDork": false,
"registration": false,
"editUrl": false,
"api": false,
"invitationOnly": false,
"deprecated": false
},
{
"name": "MicroBurst (T)",
"type": "url",
"url": "https://github.com/NetSPI/MicroBurst"
"url": "https://github.com/NetSPI/MicroBurst",
"description": "PowerShell collection focused on Azure security assessment, including subscription discovery and cloud service misconfiguration checks.",
"status": "live",
"pricing": "free",
"bestFor": "Azure subscription and service-level exposure testing",
"input": "Azure tenant/subscription context and optional credentials",
"output": "Recon data and security findings for Azure resources",
"opsec": "active",
"opsecNote": "Runs active checks against Azure control/data plane endpoints.",
"localInstall": true,
"googleDork": false,
"registration": false,
"editUrl": false,
"api": false,
"invitationOnly": false,
"deprecated": false
},
{
"name": "ROADtools (T)",
"type": "url",
"url": "https://github.com/dirkjanm/roadtools",
"description": "Azure AD exploration framework for dumping tenant objects, principals, and permissions to support attack-path and privilege analysis.",
"status": "live",
"pricing": "free",
"bestFor": "Enumerating Azure AD objects and privilege relationships",
"input": "Azure AD tenant context and authentication tokens/credentials",
"output": "Users, groups, applications, roles, and privilege mappings",
"opsec": "active",
"opsecNote": "Interacts directly with Microsoft Graph and Azure AD endpoints.",
"localInstall": true,
"googleDork": false,
"registration": false,
"editUrl": false,
"api": true,
"invitationOnly": false,
"deprecated": false
},
{
"name": "Stormspotter (T)",
"type": "url",
"url": "https://github.com/Azure/Stormspotter"
"url": "https://github.com/Azure/Stormspotter",
"description": "Graph-based Azure reconnaissance platform that maps cloud attack paths and trust relationships using Neo4j-backed visualization.",
"status": "live",
"pricing": "free",
"bestFor": "Visual analysis of Azure attack paths and privilege chains",
"input": "Azure subscription/tenant metadata collected by collectors",
"output": "Interactive graph of Azure identities, resources, and attack edges",
"opsec": "active",
"opsecNote": "Collection phase performs authenticated queries against Azure APIs.",
"localInstall": true,
"googleDork": false,
"registration": false,
"editUrl": false,
"api": true,
"invitationOnly": false,
"deprecated": false
}
]
},
@@ -4081,29 +4201,104 @@
"type": "folder",
"children": [
{
"name": "Public Buckets",
"name": "BucketLoot (T)",
"type": "url",
"url": "https://buckets.grayhatwarfare.com/"
"url": "https://github.com/redhuntlabs/BucketLoot",
"description": "Open-source cloud bucket discovery utility with limited current documentation and unclear maintenance signals.",
"status": "degraded",
"pricing": "free",
"bestFor": "Supplemental bucket discovery when validating legacy workflows",
"input": "Bucket name patterns and target-related keywords",
"output": "Candidate bucket names and accessible resource indications",
"opsec": "Unknown",
"opsecNote": "Insufficient current documentation to classify behavior confidently.",
"localInstall": true,
"googleDork": false,
"registration": false,
"editUrl": false,
"api": false,
"invitationOnly": false,
"deprecated": false
},
{
"name": "goblob (T)",
"type": "url",
"url": "https://github.com/Macmod/goblob"
},
{
"name": "S3Scanner (T)",
"type": "url",
"url": "https://github.com/sa7mon/s3scanner"
},
{
"name": "BucketLoot (T)",
"type": "url",
"url": "https://github.com/redhuntlabs/BucketLoot"
"url": "https://github.com/Macmod/goblob",
"description": "Go-based Azure blob storage enumeration utility designed for fast discovery of publicly exposed containers and blobs.",
"status": "live",
"pricing": "free",
"bestFor": "Enumerating Azure blob container exposure quickly",
"input": "Target naming patterns and optional custom wordlists",
"output": "Discovered blob storage endpoints and access results",
"opsec": "active",
"opsecNote": "Sends direct requests to Azure storage endpoints during enumeration.",
"localInstall": true,
"googleDork": false,
"registration": false,
"editUrl": false,
"api": false,
"invitationOnly": false,
"deprecated": false
},
{
"name": "lazys3 (T)",
"type": "url",
"url": "https://github.com/nahamsec/lazys3"
"url": "https://github.com/nahamsec/lazys3",
"description": "S3 bucket brute-forcing utility that generates candidate names from permutations and checks bucket accessibility.",
"status": "live",
"pricing": "free",
"bestFor": "Quick permutation-based S3 bucket name discovery",
"input": "Base target keywords and optional custom wordlists",
"output": "Potential S3 buckets with accessible bucket responses",
"opsec": "active",
"opsecNote": "Performs direct requests against AWS S3 bucket endpoints.",
"localInstall": true,
"googleDork": false,
"registration": false,
"editUrl": false,
"api": false,
"invitationOnly": false,
"deprecated": false
},
{
"name": "Public Buckets",
"type": "url",
"url": "https://buckets.grayhatwarfare.com/",
"description": "Search interface for publicly indexed cloud object storage buckets and files across multiple providers.",
"status": "live",
"pricing": "freemium",
"bestFor": "Investigating exposed bucket contents without running local scanners",
"input": "Keywords, domains, filenames, and object metadata filters",
"output": "Indexed public bucket/object matches with downloadable links",
"opsec": "passive",
"opsecNote": "Queries an existing index rather than probing target infrastructure directly.",
"localInstall": false,
"googleDork": false,
"registration": true,
"editUrl": false,
"api": false,
"invitationOnly": false,
"deprecated": false
},
{
"name": "S3Scanner (T)",
"type": "url",
"url": "https://github.com/sa7mon/s3scanner",
"description": "Command-line scanner for enumerating and checking S3 bucket misconfigurations across AWS and compatible object storage services.",
"status": "live",
"pricing": "free",
"bestFor": "Validating bucket exposure and permissions across S3-compatible targets",
"input": "Bucket names, generated candidates, or wordlist-driven targets",
"output": "Bucket existence and permission states (list/read/write/public indicators)",
"opsec": "active",
"opsecNote": "Actively queries cloud storage endpoints and leaves provider-side request logs.",
"localInstall": true,
"googleDork": false,
"registration": false,
"editUrl": false,
"api": false,
"invitationOnly": false,
"deprecated": false
}
]
},
@@ -4112,29 +4307,104 @@
"type": "folder",
"children": [
{
"name": "Prowler (T)",
"name": "Checkov (T)",
"type": "url",
"url": "https://github.com/prowler-cloud/prowler"
},
{
"name": "ScoutSuite (T)",
"type": "url",
"url": "https://github.com/nccgroup/ScoutSuite"
"url": "https://github.com/bridgecrewio/checkov",
"description": "Infrastructure-as-code security scanner that checks Terraform, CloudFormation, Kubernetes, and other cloud configs against policy rules.",
"status": "live",
"pricing": "free",
"bestFor": "Shift-left cloud misconfiguration detection in IaC repositories",
"input": "IaC source files, templates, and configuration manifests",
"output": "Policy violations with severity and remediation context",
"opsec": "passive",
"opsecNote": "Analyzes local code/config files without probing target cloud environments directly.",
"localInstall": true,
"googleDork": false,
"registration": false,
"editUrl": false,
"api": false,
"invitationOnly": false,
"deprecated": false
},
{
"name": "Cloud Custodian (T)",
"type": "url",
"url": "https://github.com/cloud-custodian/cloud-custodian"
"url": "https://github.com/cloud-custodian/cloud-custodian",
"description": "Policy-as-code engine for cloud governance and security that can detect and remediate risky cloud configurations.",
"status": "live",
"pricing": "free",
"bestFor": "Automated cloud governance and continuous configuration enforcement",
"input": "Cloud account credentials and YAML policy definitions",
"output": "Matched resources, policy findings, and optional remediation actions",
"opsec": "active",
"opsecNote": "Uses cloud APIs directly and can trigger enforcement actions when configured.",
"localInstall": true,
"googleDork": false,
"registration": false,
"editUrl": false,
"api": true,
"invitationOnly": false,
"deprecated": false
},
{
"name": "Checkov (T)",
"name": "Prowler (T)",
"type": "url",
"url": "https://github.com/bridgecrewio/checkov"
"url": "https://github.com/prowler-cloud/prowler",
"description": "Cloud security posture and compliance assessment framework covering AWS, Azure, GCP, Kubernetes, and SaaS surfaces.",
"status": "live",
"pricing": "freemium",
"bestFor": "Broad cloud security and compliance baseline assessments",
"input": "Cloud account credentials, profiles, and optional compliance benchmarks",
"output": "Findings by control/check with compliance mapping and export options",
"opsec": "active",
"opsecNote": "Performs authenticated API checks against cloud environments and logs activity.",
"localInstall": true,
"googleDork": false,
"registration": false,
"editUrl": false,
"api": true,
"invitationOnly": false,
"deprecated": false
},
{
"name": "ScoutSuite (T)",
"type": "url",
"url": "https://github.com/nccgroup/ScoutSuite",
"description": "Multi-cloud auditing tool that inventories cloud resources and highlights security risks in an interactive HTML report.",
"status": "live",
"pricing": "free",
"bestFor": "Snapshot-style multi-cloud security posture reviews",
"input": "Cloud account credentials and provider-specific profile configuration",
"output": "Interactive audit report with categorized misconfiguration findings",
"opsec": "active",
"opsecNote": "Collects cloud metadata directly from provider APIs using granted credentials.",
"localInstall": true,
"googleDork": false,
"registration": false,
"editUrl": false,
"api": false,
"invitationOnly": false,
"deprecated": false
},
{
"name": "Steampipe (T)",
"type": "url",
"url": "https://github.com/turbot/steampipe"
"url": "https://github.com/turbot/steampipe",
"description": "SQL interface over cloud APIs and services, enabling ad hoc querying of AWS, Azure, GCP, and many other data sources.",
"status": "live",
"pricing": "freemium",
"bestFor": "SQL-driven cloud inventory and security query workflows",
"input": "SQL queries and plugin connections to cloud/provider APIs",
"output": "Tabular query results from live cloud metadata",
"opsec": "active",
"opsecNote": "Executes API-backed queries against connected cloud accounts.",
"localInstall": true,
"googleDork": false,
"registration": false,
"editUrl": false,
"api": true,
"invitationOnly": false,
"deprecated": false
}
]
},
@@ -4145,25 +4415,35 @@
{
"name": "Amass (T)",
"type": "url",
"url": "https://github.com/owasp-amass/amass"
},
{
"name": "Sublist3r (T)",
"type": "url",
"url": "https://github.com/aboul3la/Sublist3r"
},
{
"name": "theHarvester (T)",
"type": "url",
"url": "https://github.com/laramies/theHarvester",
"description": "Command-line tool for gathering emails, subdomains, IPs, and URLs from public sources.",
"url": "https://github.com/owasp-amass/amass",
"description": "Advanced attack surface mapping framework for DNS and subdomain enumeration with graph correlation and extensive data-source support.",
"status": "live",
"pricing": "free",
"bestFor": "Email harvesting, subdomain enumeration, passive recon",
"input": "Domain name",
"output": "Email addresses, subdomains, IPs, URLs",
"opsec": "passive",
"opsecNote": "Queries third-party search engines and APIs. Does not contact the target directly.",
"bestFor": "Comprehensive external attack-surface and subdomain mapping",
"input": "Domain names, ASN data, CIDRs, and optional API credentials",
"output": "Correlated graph of domains, subdomains, infrastructure, and relationships",
"opsec": "active",
"opsecNote": "Supports both passive and active techniques, including DNS probing and brute-force modes.",
"localInstall": true,
"googleDork": false,
"registration": true,
"editUrl": false,
"api": true,
"invitationOnly": false,
"deprecated": false
},
{
"name": "dnsrecon (T)",
"type": "url",
"url": "https://github.com/darkoperator/dnsrecon",
"description": "DNS enumeration script for recon workflows, supporting record discovery, zone transfer checks, brute-force, and reverse lookups.",
"status": "live",
"pricing": "free",
"bestFor": "Detailed DNS reconnaissance and validation",
"input": "Domain names, name servers, and optional DNS wordlists",
"output": "DNS records, discovered hosts, and transfer/bruteforce findings",
"opsec": "active",
"opsecNote": "Performs direct DNS queries and active enumeration techniques against target infrastructure.",
"localInstall": true,
"googleDork": false,
"registration": false,
@@ -4193,9 +4473,44 @@
"deprecated": false
},
{
"name": "dnsrecon (T)",
"name": "Sublist3r (T)",
"type": "url",
"url": "https://github.com/darkoperator/dnsrecon"
"url": "https://github.com/aboul3la/Sublist3r",
"description": "Passive subdomain enumeration tool that aggregates subdomains from public search engines and certificate-related sources.",
"status": "live",
"pricing": "free",
"bestFor": "Quick passive subdomain discovery for reconnaissance",
"input": "Domain name",
"output": "Discovered subdomain list and optional live-host checks",
"opsec": "passive",
"opsecNote": "Primarily uses third-party data sources and search interfaces for discovery.",
"localInstall": true,
"googleDork": false,
"registration": false,
"editUrl": false,
"api": false,
"invitationOnly": false,
"deprecated": false
},
{
"name": "theHarvester (T)",
"type": "url",
"url": "https://github.com/laramies/theHarvester",
"description": "Reconnaissance tool for gathering emails, domains, hosts, and employee-related intelligence from public search and data sources.",
"status": "live",
"pricing": "free",
"bestFor": "Email and host discovery tied to a target organization",
"input": "Domain names, company names, and selected data-source modules",
"output": "Emails, hosts, domains, IPs, and related reconnaissance artifacts",
"opsec": "passive",
"opsecNote": "Queries third-party search engines and APIs. Does not contact the target directly.",
"localInstall": true,
"googleDork": false,
"registration": false,
"editUrl": false,
"api": true,
"invitationOnly": false,
"deprecated": false
}
]
}
@@ -17778,4 +18093,4 @@
]
}
]
}
}