diff --git a/public/arf.json b/public/arf.json index d77fee6..8a9aaba 100644 --- a/public/arf.json +++ b/public/arf.json @@ -4028,20 +4028,65 @@ "name": "AWS Enumeration", "type": "folder", "children": [ - { - "name": "cloud_enum (T)", - "type": "url", - "url": "https://github.com/initstring/cloud_enum" - }, { "name": "AWSBucketDump (T)", "type": "url", - "url": "https://github.com/jordanpotti/AWSBucketDump" + "url": "https://github.com/jordanpotti/AWSBucketDump", + "description": "Python tool that enumerates AWS S3 buckets and optionally downloads accessible objects using keyword and pattern-based discovery.", + "status": "live", + "pricing": "free", + "bestFor": "Targeted S3 bucket discovery and object collection", + "input": "AWS account naming patterns, keywords, and optional wordlists", + "output": "Discovered bucket names and downloadable object listings/files", + "opsec": "active", + "opsecNote": "Actively sends requests to S3 endpoints and can download objects.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "cloud_enum (T)", + "type": "url", + "url": "https://github.com/initstring/cloud_enum", + "description": "Multi-cloud enumeration tool that looks for exposed AWS, Azure, and GCP storage assets from target naming patterns.", + "status": "live", + "pricing": "free", + "bestFor": "Rapid discovery of cloud storage exposure across major providers", + "input": "Company names, domains, and custom keywords/wordlists", + "output": "Potentially exposed cloud storage resources by provider", + "opsec": "active", + "opsecNote": "Performs direct enumeration requests against cloud provider endpoints.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Subfinder (T)", "type": "url", - "url": "https://github.com/projectdiscovery/subfinder" + "url": "https://github.com/projectdiscovery/subfinder", + "description": "Fast passive subdomain discovery utility that aggregates results from many curated OSINT and API-backed sources.", + "status": "live", + "pricing": "free", + "bestFor": "Passive subdomain enumeration for cloud asset inventorying", + "input": "Domain name and optional API credentials for data sources", + "output": "Resolved and unresolved subdomain candidates", + "opsec": "passive", + "opsecNote": "Uses third-party data sources by default and avoids active probing unless paired with other tools.", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -4049,30 +4094,105 @@ "name": "Azure/GCP Discovery", "type": "folder", "children": [ - { - "name": "GCPBucketBrute (T)", - "type": "url", - "url": "https://github.com/RhinoSecurityLabs/GCPBucketBrute" - }, { "name": "AADInternals (T)", "type": "url", - "url": "https://github.com/Gerenios/AADInternals" + "url": "https://github.com/Gerenios/AADInternals", + "description": "PowerShell toolkit for Azure AD and Entra ID assessment, including tenant reconnaissance and hybrid identity attack-path analysis.", + "status": "live", + "pricing": "free", + "bestFor": "Deep Azure AD reconnaissance and security assessment", + "input": "Tenant identifiers, domain names, and account context", + "output": "Tenant/user intelligence, configuration findings, and attack-path indicators", + "opsec": "active", + "opsecNote": "Queries Microsoft identity services directly and may generate tenant-visible activity.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { - "name": "ROADtools (T)", + "name": "GCPBucketBrute (T)", "type": "url", - "url": "https://github.com/dirkjanm/roadtools" + "url": "https://github.com/RhinoSecurityLabs/GCPBucketBrute", + "description": "Google Cloud Storage bucket enumeration utility for identifying publicly accessible or weakly protected buckets.", + "status": "live", + "pricing": "free", + "bestFor": "Enumerating likely GCS bucket names at scale", + "input": "Target company names, domains, and custom wordlists", + "output": "Valid bucket names with access status and findings", + "opsec": "active", + "opsecNote": "Performs direct requests against GCS endpoints and can be detected in provider logs.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "MicroBurst (T)", "type": "url", - "url": "https://github.com/NetSPI/MicroBurst" + "url": "https://github.com/NetSPI/MicroBurst", + "description": "PowerShell collection focused on Azure security assessment, including subscription discovery and cloud service misconfiguration checks.", + "status": "live", + "pricing": "free", + "bestFor": "Azure subscription and service-level exposure testing", + "input": "Azure tenant/subscription context and optional credentials", + "output": "Recon data and security findings for Azure resources", + "opsec": "active", + "opsecNote": "Runs active checks against Azure control/data plane endpoints.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "ROADtools (T)", + "type": "url", + "url": "https://github.com/dirkjanm/roadtools", + "description": "Azure AD exploration framework for dumping tenant objects, principals, and permissions to support attack-path and privilege analysis.", + "status": "live", + "pricing": "free", + "bestFor": "Enumerating Azure AD objects and privilege relationships", + "input": "Azure AD tenant context and authentication tokens/credentials", + "output": "Users, groups, applications, roles, and privilege mappings", + "opsec": "active", + "opsecNote": "Interacts directly with Microsoft Graph and Azure AD endpoints.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Stormspotter (T)", "type": "url", - "url": "https://github.com/Azure/Stormspotter" + "url": "https://github.com/Azure/Stormspotter", + "description": "Graph-based Azure reconnaissance platform that maps cloud attack paths and trust relationships using Neo4j-backed visualization.", + "status": "live", + "pricing": "free", + "bestFor": "Visual analysis of Azure attack paths and privilege chains", + "input": "Azure subscription/tenant metadata collected by collectors", + "output": "Interactive graph of Azure identities, resources, and attack edges", + "opsec": "active", + "opsecNote": "Collection phase performs authenticated queries against Azure APIs.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -4081,29 +4201,104 @@ "type": "folder", "children": [ { - "name": "Public Buckets", + "name": "BucketLoot (T)", "type": "url", - "url": "https://buckets.grayhatwarfare.com/" + "url": "https://github.com/redhuntlabs/BucketLoot", + "description": "Open-source cloud bucket discovery utility with limited current documentation and unclear maintenance signals.", + "status": "degraded", + "pricing": "free", + "bestFor": "Supplemental bucket discovery when validating legacy workflows", + "input": "Bucket name patterns and target-related keywords", + "output": "Candidate bucket names and accessible resource indications", + "opsec": "Unknown", + "opsecNote": "Insufficient current documentation to classify behavior confidently.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "goblob (T)", "type": "url", - "url": "https://github.com/Macmod/goblob" - }, - { - "name": "S3Scanner (T)", - "type": "url", - "url": "https://github.com/sa7mon/s3scanner" - }, - { - "name": "BucketLoot (T)", - "type": "url", - "url": "https://github.com/redhuntlabs/BucketLoot" + "url": "https://github.com/Macmod/goblob", + "description": "Go-based Azure blob storage enumeration utility designed for fast discovery of publicly exposed containers and blobs.", + "status": "live", + "pricing": "free", + "bestFor": "Enumerating Azure blob container exposure quickly", + "input": "Target naming patterns and optional custom wordlists", + "output": "Discovered blob storage endpoints and access results", + "opsec": "active", + "opsecNote": "Sends direct requests to Azure storage endpoints during enumeration.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "lazys3 (T)", "type": "url", - "url": "https://github.com/nahamsec/lazys3" + "url": "https://github.com/nahamsec/lazys3", + "description": "S3 bucket brute-forcing utility that generates candidate names from permutations and checks bucket accessibility.", + "status": "live", + "pricing": "free", + "bestFor": "Quick permutation-based S3 bucket name discovery", + "input": "Base target keywords and optional custom wordlists", + "output": "Potential S3 buckets with accessible bucket responses", + "opsec": "active", + "opsecNote": "Performs direct requests against AWS S3 bucket endpoints.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Public Buckets", + "type": "url", + "url": "https://buckets.grayhatwarfare.com/", + "description": "Search interface for publicly indexed cloud object storage buckets and files across multiple providers.", + "status": "live", + "pricing": "freemium", + "bestFor": "Investigating exposed bucket contents without running local scanners", + "input": "Keywords, domains, filenames, and object metadata filters", + "output": "Indexed public bucket/object matches with downloadable links", + "opsec": "passive", + "opsecNote": "Queries an existing index rather than probing target infrastructure directly.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "S3Scanner (T)", + "type": "url", + "url": "https://github.com/sa7mon/s3scanner", + "description": "Command-line scanner for enumerating and checking S3 bucket misconfigurations across AWS and compatible object storage services.", + "status": "live", + "pricing": "free", + "bestFor": "Validating bucket exposure and permissions across S3-compatible targets", + "input": "Bucket names, generated candidates, or wordlist-driven targets", + "output": "Bucket existence and permission states (list/read/write/public indicators)", + "opsec": "active", + "opsecNote": "Actively queries cloud storage endpoints and leaves provider-side request logs.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -4112,29 +4307,104 @@ "type": "folder", "children": [ { - "name": "Prowler (T)", + "name": "Checkov (T)", "type": "url", - "url": "https://github.com/prowler-cloud/prowler" - }, - { - "name": "ScoutSuite (T)", - "type": "url", - "url": "https://github.com/nccgroup/ScoutSuite" + "url": "https://github.com/bridgecrewio/checkov", + "description": "Infrastructure-as-code security scanner that checks Terraform, CloudFormation, Kubernetes, and other cloud configs against policy rules.", + "status": "live", + "pricing": "free", + "bestFor": "Shift-left cloud misconfiguration detection in IaC repositories", + "input": "IaC source files, templates, and configuration manifests", + "output": "Policy violations with severity and remediation context", + "opsec": "passive", + "opsecNote": "Analyzes local code/config files without probing target cloud environments directly.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Cloud Custodian (T)", "type": "url", - "url": "https://github.com/cloud-custodian/cloud-custodian" + "url": "https://github.com/cloud-custodian/cloud-custodian", + "description": "Policy-as-code engine for cloud governance and security that can detect and remediate risky cloud configurations.", + "status": "live", + "pricing": "free", + "bestFor": "Automated cloud governance and continuous configuration enforcement", + "input": "Cloud account credentials and YAML policy definitions", + "output": "Matched resources, policy findings, and optional remediation actions", + "opsec": "active", + "opsecNote": "Uses cloud APIs directly and can trigger enforcement actions when configured.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { - "name": "Checkov (T)", + "name": "Prowler (T)", "type": "url", - "url": "https://github.com/bridgecrewio/checkov" + "url": "https://github.com/prowler-cloud/prowler", + "description": "Cloud security posture and compliance assessment framework covering AWS, Azure, GCP, Kubernetes, and SaaS surfaces.", + "status": "live", + "pricing": "freemium", + "bestFor": "Broad cloud security and compliance baseline assessments", + "input": "Cloud account credentials, profiles, and optional compliance benchmarks", + "output": "Findings by control/check with compliance mapping and export options", + "opsec": "active", + "opsecNote": "Performs authenticated API checks against cloud environments and logs activity.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "ScoutSuite (T)", + "type": "url", + "url": "https://github.com/nccgroup/ScoutSuite", + "description": "Multi-cloud auditing tool that inventories cloud resources and highlights security risks in an interactive HTML report.", + "status": "live", + "pricing": "free", + "bestFor": "Snapshot-style multi-cloud security posture reviews", + "input": "Cloud account credentials and provider-specific profile configuration", + "output": "Interactive audit report with categorized misconfiguration findings", + "opsec": "active", + "opsecNote": "Collects cloud metadata directly from provider APIs using granted credentials.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Steampipe (T)", "type": "url", - "url": "https://github.com/turbot/steampipe" + "url": "https://github.com/turbot/steampipe", + "description": "SQL interface over cloud APIs and services, enabling ad hoc querying of AWS, Azure, GCP, and many other data sources.", + "status": "live", + "pricing": "freemium", + "bestFor": "SQL-driven cloud inventory and security query workflows", + "input": "SQL queries and plugin connections to cloud/provider APIs", + "output": "Tabular query results from live cloud metadata", + "opsec": "active", + "opsecNote": "Executes API-backed queries against connected cloud accounts.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -4145,25 +4415,35 @@ { "name": "Amass (T)", "type": "url", - "url": "https://github.com/owasp-amass/amass" - }, - { - "name": "Sublist3r (T)", - "type": "url", - "url": "https://github.com/aboul3la/Sublist3r" - }, - { - "name": "theHarvester (T)", - "type": "url", - "url": "https://github.com/laramies/theHarvester", - "description": "Command-line tool for gathering emails, subdomains, IPs, and URLs from public sources.", + "url": "https://github.com/owasp-amass/amass", + "description": "Advanced attack surface mapping framework for DNS and subdomain enumeration with graph correlation and extensive data-source support.", "status": "live", "pricing": "free", - "bestFor": "Email harvesting, subdomain enumeration, passive recon", - "input": "Domain name", - "output": "Email addresses, subdomains, IPs, URLs", - "opsec": "passive", - "opsecNote": "Queries third-party search engines and APIs. Does not contact the target directly.", + "bestFor": "Comprehensive external attack-surface and subdomain mapping", + "input": "Domain names, ASN data, CIDRs, and optional API credentials", + "output": "Correlated graph of domains, subdomains, infrastructure, and relationships", + "opsec": "active", + "opsecNote": "Supports both passive and active techniques, including DNS probing and brute-force modes.", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "dnsrecon (T)", + "type": "url", + "url": "https://github.com/darkoperator/dnsrecon", + "description": "DNS enumeration script for recon workflows, supporting record discovery, zone transfer checks, brute-force, and reverse lookups.", + "status": "live", + "pricing": "free", + "bestFor": "Detailed DNS reconnaissance and validation", + "input": "Domain names, name servers, and optional DNS wordlists", + "output": "DNS records, discovered hosts, and transfer/bruteforce findings", + "opsec": "active", + "opsecNote": "Performs direct DNS queries and active enumeration techniques against target infrastructure.", "localInstall": true, "googleDork": false, "registration": false, @@ -4193,9 +4473,44 @@ "deprecated": false }, { - "name": "dnsrecon (T)", + "name": "Sublist3r (T)", "type": "url", - "url": "https://github.com/darkoperator/dnsrecon" + "url": "https://github.com/aboul3la/Sublist3r", + "description": "Passive subdomain enumeration tool that aggregates subdomains from public search engines and certificate-related sources.", + "status": "live", + "pricing": "free", + "bestFor": "Quick passive subdomain discovery for reconnaissance", + "input": "Domain name", + "output": "Discovered subdomain list and optional live-host checks", + "opsec": "passive", + "opsecNote": "Primarily uses third-party data sources and search interfaces for discovery.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "theHarvester (T)", + "type": "url", + "url": "https://github.com/laramies/theHarvester", + "description": "Reconnaissance tool for gathering emails, domains, hosts, and employee-related intelligence from public search and data sources.", + "status": "live", + "pricing": "free", + "bestFor": "Email and host discovery tied to a target organization", + "input": "Domain names, company names, and selected data-source modules", + "output": "Emails, hosts, domains, IPs, and related reconnaissance artifacts", + "opsec": "passive", + "opsecNote": "Queries third-party search engines and APIs. Does not contact the target directly.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] } @@ -17778,4 +18093,4 @@ ] } ] -} \ No newline at end of file +}