AWS IAM Privilege Escalation Scanner
Caller identity enumeration User policy analysis (attached + inline + group) 18 known privesc pattern detection Assumable role discovery with trust policy analy
Arsenal
Professional offensive security tools & exploit frameworks
98
Tools
12
Categories
Kubernetes RBAC Auditor
ClusterRole analysis (wildcard, dangerous verbs) 8 known privesc pattern detection (exec, secrets, impersonate, bind) ClusterRoleBinding audit (SA with cluster-
Azure AD Password Sprayer
OAuth2, Autologon, and Graph API endpoints Smart lockout detection and cooldown MFA detection (AADSTS50076/50079) Account status detection (locked, disabled, ex
Docker Container Escape Exploits
Privileged mode detection and host mount exploit Docker socket detection and API abuse Host filesystem mount detection Cgroup escape (CVE-2022-0492) /proc core_
Terraform Security Scanner
15 built-in security rules (hardcoded creds, public S3, open SGs, wildcard IAM) Terraform plan JSON analysis for pre-deploy checks Severity-rated findings with
Cloud Metadata SSRF Exploiter
AWS IMDSv1/v2, GCP, Azure, DigitalOcean, Alibaba Cloud 11 bypass techniques (decimal IP, hex, octal, URL encode, DNS rebind) Credential extraction and analysis
S3 Bucket Enumeration & Pillage
Smart bucket name generation from target base name Public listing, read, and authenticated access detection Sensitive file pattern matching (env, keys, configs,
GCP Service Account Key Finder
Metadata service enumeration (token, scopes, project) Environment variable scanning (7 known GCP vars) Filesystem search for SA JSON key files gcloud CLI config
CI/CD Pipeline Poisoning Kit
Auto-detect platform (Jenkins, GitLab, GitHub) Jenkins: Groovy console, credential extraction, job config analysis GitLab: CI/CD variable exposure, pipeline inj
Cloud Firewall Rule Analyzer
AWS Security Groups, Azure NSGs, GCP Firewall Rules Detects all-traffic-open, admin/DB ports public, wide ranges Severity classification (CRITICAL/HIGH/MEDIUM/L