{"id":4405,"url":"https://github.com/teamssix/awesome-cloud-security","name":"awesome-cloud-security","description":"awesome cloud security 收集一些国内外不错的云安全资源，该项目主要面向国内的安全人员","projects_count":297,"last_synced_at":"2026-07-22T14:00:24.644Z","repository":{"id":37414966,"uuid":"481618302","full_name":"teamssix/awesome-cloud-security","owner":"teamssix","description":"awesome cloud security 收集一些国内外不错的云安全资源，该项目主要面向国内的安全人员","archived":false,"fork":false,"pushed_at":"2024-10-28T11:25:37.000Z","size":12063,"stargazers_count":2095,"open_issues_count":2,"forks_count":236,"subscribers_count":24,"default_branch":"main","last_synced_at":"2026-05-30T16:03:00.138Z","etag":null,"topics":["awesome","awesome-cloud-security","cloud-native","cloud-security","cloudnative","cloudsecurity","cybersecurity","docker","kubernetes","tools"],"latest_commit_sha":null,"homepage":"https://wiki.teamssix.com/cloudsecurityresources/","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/teamssix.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2022-04-14T13:38:22.000Z","updated_at":"2026-05-24T08:38:14.000Z","dependencies_parsed_at":"2024-05-29T05:06:23.089Z","dependency_job_id":"265fa52e-7bde-40f8-8f17-b4b2ed743aa5","html_url":"https://github.com/teamssix/awesome-cloud-security","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/teamssix/awesome-cloud-security","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/teamssix%2Fawesome-cloud-security","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/teamssix%2Fawesome-cloud-security/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/teamssix%2Fawesome-cloud-security/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/teamssix%2Fawesome-cloud-security/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/teamssix","download_url":"https://codeload.github.com/teamssix/awesome-cloud-security/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/teamssix%2Fawesome-cloud-security/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34393305,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-16T02:00:06.860Z","response_time":126,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"created_at":"2024-01-06T20:24:54.978Z","updated_at":"2026-07-22T14:00:24.644Z","primary_language":null,"list_of_lists":false,"displayable":true,"categories":["0x01 资料 :books:","0x02 工具 :hammer_and_wrench:","0x03 靶场 :dart:","更新日志 :calendar:"],"sub_categories":["7 证书","1 云服务工具","云服务靶场","1 综合","2 博客资讯","4 推特","6 视频","8 云服务文章","9 云原生文章","2 云原生工具","想要一起补充？直接给本项目提 PR 或者使用右侧链接中的方法：[补充说明地址](https://wiki.teamssix.com/About/Contribute.html)","云原生靶场"],"readme":"\u003ch1 align=\"center\"\u003eAwesome Cloud Security 云安全资源汇总 💫 \u003c/h1\u003e\n\u003cp align=\"center\"\u003e\n    \u003ca href=\"https://github.com/teamssix/awesome-cloud-security/stargazers\"\u003e\u003cimg alt=\"GitHub stars\" src=\"https://img.shields.io/github/stars/teamssix/awesome-cloud-security\" /\u003e\u003c/a\u003e\n    \u003ca href=\"https://wiki.teamssix.com\"\u003e\u003cimg alt=\"T Wiki\" src=\"https://img.shields.io/badge/T%20Wiki%20-%E4%BA%91%E5%AE%89%E5%85%A8%E7%9F%A5%E8%AF%86%E6%96%87%E5%BA%93-blue\" /\u003e\u003c/a\u003e\n    \u003ca href=\"https://wiki.wgpsec.org\"\u003e\u003cimg alt=\"WgpSec Wiki\" src=\"https://img.shields.io/badge/%E7%8B%BC%E7%BB%84%E5%AE%89%E5%85%A8%E5%9B%A2%E9%98%9F-%E7%9F%A5%E8%AF%86%E6%96%87%E5%BA%93-blue\" /\u003e\u003c/a\u003e\n    \u003ca href=\"http://wiki.peiqi.tech\"\u003e\u003cimg alt=\"PeiQi Wiki\" src=\"https://img.shields.io/badge/PeiQi-%E7%9F%A5%E8%AF%86%E6%96%87%E5%BA%93-blue\" /\u003e\u003c/a\u003e\n    \u003c/a\u003e\n    \u003ca href=\"https://twitter.com/intent/tweet/?text=Awesome%20Cloud%20Security%20%20%E4%BA%91%E5%AE%89%E5%85%A8%E8%B5%84%E6%BA%90%E6%B1%87%E6%80%BB%20%F0%9F%92%AB%20%0Ahttps%3A%2F%2Fgithub.com%2Fteamssix%2Fawesome-cloud-security%0A%23awesome%20%23cloud%20%23security%20%23cloudsecurity%20%23cybersecurtiy\"\u003e\u003cimg alt=\"tweet\" src=\"https://img.shields.io/twitter/url?url=https://github.com/teamssix/awesome-cloud-security\" /\u003e\u003c/a\u003e\n    \u003ca href=\"https://twitter.com/teamssix\"\u003e\u003cimg alt=\"Twitter\" src=\"https://img.shields.io/twitter/follow/teamssix?label=Followers\u0026style=social\" /\u003e\u003c/a\u003e\n\u003c/p\u003e\n\n\n\nAwesome Cloud Security 项目是从 T Wiki 云安全知识文库独立出来的一个项目， T Wiki 云安全知识文库中包含了自己在云安全方向的学习笔记以及大家一起贡献补充的云安全资源， T Wiki 云安全知识文库地址：[wiki.teamssix.com](https://wiki.teamssix.com)\n\nThe Awesome Cloud Security project is from the T Wiki cloud security knowledge base, The T Wiki cloud security knowledge base contains my learning notes on cloud security and cloud security resources contributed by everyone, T Wiki cloud security knowledge base site: [wiki.teamssix.com](https://wiki.teamssix.com)\n\n\u003e 提示：Mac 按住 command 键，Windows 或 Linux 按住 ctrl 键，然后再点击链接可以在新标签页中打开\n\n## 0x01 资料 :books:\n\n### 1 综合\n\n* T Wiki 云安全知识文库 :fire: [地址](https://wiki.teamssix.com/)\n* Hacking The Cloud（英文） [地址](https://hackingthe.cloud/)\n* Cloud Security Wiki By NotSoSecure（英文）[地址](https://cloudsecwiki.com/index.html)\n* Cloud Security Wiki By WithSecure（英文）[地址](https://www.secwiki.cloud/)  `由「Kagantua」师傅补充，感谢支持`\n* 云服务漏洞库（英文）[地址](https://www.cloudvulndb.org/)\n* 2021 年云安全事件回顾（英文）[地址](https://blog.christophetd.fr/cloud-security-breaches-and-vulnerabilities-2021-in-review/)\n* 云渗透技巧 HackTricks Cloud（英文）[地址](https://cloud.hacktricks.xyz)\n* 云风险百科（英文）[地址](https://orca.security/resources/cloud-risk-encyclopedia/)\n* 火线云安全知识库 [地址](https://cloudsec.huoxian.cn/)\n* 云安全文库（英文）[地址](https://cloudsecdocs.com)\n* Sysdig 2023 年全球云威胁报告（英文） [地址](https://sysdig.com/blog/2023-global-cloud-threat-report)\n* 云渗透笔记 CloudPentestCheatsheets（英文）[地址](https://github.com/dafthack/CloudPentestCheatsheets) ![GitHub stars](https://img.shields.io/github/stars/dafthack/CloudPentestCheatsheets) `由「Kfzz1」师傅补充，感谢支持`\n* AWS 攻击知识库 WeirdAAL (英文) [地址](https://github.com/carnal0wnage/weirdAAL) ![GitHub stars](https://img.shields.io/github/stars/carnal0wnage/weirdAAL)\n* T Wiki 云安全知识文库项目 [地址](https://github.com/teamssix/TWiki) ![GitHub stars](https://img.shields.io/github/stars/teamssix/TWiki) ` T Wiki 文库现已开源，可部署到自己本地方便内网阅读`\n* 云安全入门资料 [地址](https://github.com/Esonhugh/Attack_Code) ![GitHub stars](https://img.shields.io/github/stars/Esonhugh/Attack_Code)\n* 云安全向导 [地址](https://github.com/GRQForCloud/cloud-security-guides) ![GitHub stars](https://img.shields.io/github/stars/GRQForCloud/cloud-security-guides)\n\n### 2 博客资讯\n\n* 0xd4y 博客（英文）[地址](https://0xd4y.com/)\n* Aqua 博客（英文）[地址](https://blog.aquasec.com/)\n* AWS 安全公告（英文）[地址](https://aws.amazon.com/security/security-bulletins)\n* Bridgecrew 博客（英文）[地址](https://bridgecrew.io/blog/)\n* Christophe Tafani-Dereeper 博客（英文）[地址](https://blog.christophetd.fr/)\n* Chris Farris 的个人博客（英文）[地址](https://www.chrisfarris.com/)\n* CIS Benchmarks 下载页（英文）[地址](https://downloads.cisecurity.org)\n* CNCF 博客（英文）[地址](https://www.cncf.io/blog/)\n* Deepfence 博客（英文）[地址](https://deepfence.io/blog/)\n* DevOps 安全博客（英文）[地址](https://www.conjur.org/blog/)\n* DevOps 资讯（英文）[地址](https://devops.com/)\n* Ermetic 博客（英文）[地址](https://ermetic.com/blog)\n* Gafnit Amiga 的个人博客（英文）[地址](https://gafnit.blog/)\n* HashiCorp 博客（英文）[地址](https://www.hashicorp.com/blog)\n* Humanitec 博客（英文）[地址](https://humanitec.com/blog)\n* Lacework 博客（英文）[地址](https://www.lacework.com/blog/)\n* Lightspin 博客（英文）[地址](https://blog.lightspin.io/)\n* Mystic0x1 博客（英文）[地址](https://mystic0x1.github.io/)\n* Nick Frichette 的个人博客（英文）[地址](https://frichetten.com/)\n* Orca 博客（英文）[地址](https://orca.security/resources/blog/)\n* PeoplActive 博客（英文）[地址](https://peoplactive.com/blog/)\n* Praetorian 博客（英文）[地址](https://www.praetorian.com/blog)\n* Rhino Security Labs 博客（英文）[地址](https://rhinosecuritylabs.com/blog/?category=cloud-security)\n* Sysdig 云安全报告资讯（英文）[地址](https://sysdig.com/resources/reports/)\n* Sysdig 博客（英文）[地址](https://sysdig.com/blog/)\n* TeamsSix 的个人博客 [地址](https://teamssix.com/)\n* Trend Micro 博客（英文）[地址](https://www.trendmicro.com/en_us/devops.html)\n* WIZ 博客（英文）[地址](https://www.wiz.io/blog/)\n* 安全大道资讯（英文）[地址](https://securityboulevard.com/cloud-security/)\n* 福布斯 Cloud 100（英文）[地址](https://forbes.com/lists/cloud100/)\n* 火线安全每日云安全资讯 [地址](https://cloudsec.huoxian.cn/docs/information)\n* 绿盟技术博客 [地址](http://blog.nsfocus.net/tag/%e4%ba%91%e5%ae%89%e5%85%a8/)\n* 容器杂志资讯（英文）[地址](https://containerjournal.com/)\n* 腾讯云鼎每日云安全资讯 [地址](https://cloudsec.tencent.com/info/list.html)\n* 云安全资讯（每周更新一次）（英文）[地址](https://cloudseclist.com/past-issues)\n* 云计算市场资讯（英文）[地址](https://interconnected.blog/tag/cloud-industry)\n* 云原生实验室博客 [地址](https://icloudnative.io) `由「DVKunion」师傅补充，感谢支持`\n\n### 3 公众号\n\n* TeamsSix\n* 火线 Zone\n* 云鼎实验室\n* 绿盟科技研究通讯\n* 默安逐日实验室\n* Linux 云计算网络 `由「zxynull」师傅补充，感谢支持`\n* 云原生技术社区 `由「zxynull」师傅补充，感谢支持`\n* 进击云原生 `由「zxynull」师傅补充，感谢支持`\n* CNCF\n* 容器魔方\n* 云计算D1net\n* 云原生社区动态\n* 大可不加冰\n* 小佑科技 `由「宅独青年」师傅补充，感谢支持`\n* 喵苗安全 `由「Yaney」师傅补充，感谢支持`\n* Bypass `由「glan」师傅补充，感谢支持`\n\n### 4 推特\n\n* 0xd4y [![Twitter Follow](https://img.shields.io/twitter/follow/0xd4y)](https://twitter.com/0xd4y)\n* Andy Robbins [![Twitter Follow](https://img.shields.io/twitter/follow/_wald0)](https://twitter.com/_wald0)\n* Beau Bullock [![Twitter Follow](https://img.shields.io/twitter/follow/dafthack)](https://twitter.com/dafthack)\n* Chris Farris [![Twitter Follow](https://img.shields.io/twitter/follow/jcfarris)](https://twitter.com/jcfarris)\n* Christophe Tafani-Dereeper [![Twitter Follow](https://img.shields.io/twitter/follow/christophetd)](https://twitter.com/christophetd)\n* Dirk-jan [![Twitter Follow](https://img.shields.io/twitter/follow/_dirkjan)](https://twitter.com/_dirkjan)\n* Dr. Nestori Syynimaa [![Twitter Follow](https://img.shields.io/twitter/follow/DrAzureAD)](https://twitter.com/DrAzureAD)\n* Emilien Socchi [![Twitter Follow](https://img.shields.io/twitter/follow/emiliensocchi)](https://twitter.com/emiliensocchi)\n* Fabian Bader [![Twitter Follow](https://img.shields.io/twitter/follow/fabian_bader)](https://twitter.com/fabian_bader)\n* Fawaz [![Twitter Follow](https://img.shields.io/twitter/follow/0xFawaz)](https://twitter.com/0xFawaz)\n* gafnit [![Twitter Follow](https://img.shields.io/twitter/follow/gafnitav)](https://twitter.com/gafnitav)\n* inversecosᵘʷᵘ [![Twitter Follow](https://img.shields.io/twitter/follow/inversecos)](https://twitter.com/inversecos)\n* Jason Ostrom [![Twitter Follow](https://img.shields.io/twitter/follow/securitypuck)](https://twitter.com/securitypuck)\n* Joosua Santasalo [![Twitter Follow](https://img.shields.io/twitter/follow/SantasaloJoosua)](https://twitter.com/SantasaloJoosua)\n* Karl [![Twitter Follow](https://img.shields.io/twitter/follow/kfosaaen)](https://twitter.com/kfosaaen)\n* Kfzz1 [![Twitter Follow](https://img.shields.io/twitter/follow/Kfzz12)](https://twitter.com/Kfzz12)\n* Liv Matan [![Twitter Follow](https://img.shields.io/twitter/follow/terminatorLM)](https://twitter.com/terminatorLM)\n* Marco Lancini [![Twitter Follow](https://img.shields.io/twitter/follow/lancinimarco)](https://twitter.com/lancinimarco)\n* Melvin langvik [![Twitter Follow](https://img.shields.io/twitter/follow/Flangvik)](https://twitter.com/Flangvik)\n* Merill [![Twitter Follow](https://img.shields.io/twitter/follow/merill)](https://twitter.com/merill)\n* mx7krshell [![Twitter Follow](https://img.shields.io/twitter/follow/mx7krshell)](https://twitter.com/mx7krshell)\n* Nathan McNulty [![Twitter Follow](https://img.shields.io/twitter/follow/NathanMcNulty)](https://twitter.com/NathanMcNulty)\n* Nick Frichette [![Twitter Follow](https://img.shields.io/twitter/follow/Frichette_n)](https://twitter.com/Frichette_n)\n* Nikhil Mittal [![Twitter Follow](https://img.shields.io/twitter/follow/nikhil_mitt)](https://twitter.com/nikhil_mitt)\n* Nir Ohfeld [![Twitter Follow](https://img.shields.io/twitter/follow/nirohfeld)](https://twitter.com/nirohfeld)\n* Raunak Parmar [![Twitter Follow](https://img.shields.io/twitter/follow/trouble1_raunak)](https://twitter.com/trouble1_raunak)\n* Rhino Security Labs [![Twitter Follow](https://img.shields.io/twitter/follow/RhinoSecurity)](https://twitter.com/RhinoSecurity)\n* Roberto Rodriguez [![Twitter Follow](https://img.shields.io/twitter/follow/Cyb3rWard0g)](https://twitter.com/Cyb3rWard0g)\n* rootsecdev [![Twitter Follow](https://img.shields.io/twitter/follow/rootsecdev)](https://twitter.com/rootsecdev)\n* rvrsh3ll [![Twitter Follow](https://img.shields.io/twitter/follow/424f424f)](https://twitter.com/424f424f)\n* Ryan Hausknecht [![Twitter Follow](https://img.shields.io/twitter/follow/Haus3c)](https://twitter.com/Haus3c)\n* Sami Lamppu [![Twitter Follow](https://img.shields.io/twitter/follow/samilamppu)](https://twitter.com/samilamppu)\n* Sean Metcalf [![Twitter Follow](https://img.shields.io/twitter/follow/PyroTek3)](https://twitter.com/PyroTek3)\n* Seth Art [![Twitter Follow](https://img.shields.io/twitter/follow/sethsec)](https://twitter.com/sethsec)\n* Shir Tamari [![Twitter Follow](https://img.shields.io/twitter/follow/shirtamari)](https://twitter.com/shirtamari)\n* Simon Décosse [![Twitter Follow](https://img.shields.io/twitter/follow/simondotsh)](https://twitter.com/simondotsh)\n* Skyworship [![Twitter Follow](https://img.shields.io/twitter/follow/Skyworship2)](https://twitter.com/Skyworship2)\n* Thomas Naunheim [![Twitter Follow](https://img.shields.io/twitter/follow/Thomas_Live)](https://twitter.com/Thomas_Live)\n\n### 5 书籍\n\n* 《云原生安全-攻防实践与体系构建》\n* 《Hacking Kubernetes》\n* 《Hands-On AWS Penetration Testing with Kali Linux》\n\n### 6 视频\n\n* 0xd4y 频道（英文）[地址](https://www.youtube.com/@0xd4y)\n* CNCF 频道（英文）[地址](https://youtube.com/@cncf)\n* WIZ 频道（英文）[地址](https://www.youtube.com/@wizsecurity)\n* 火线云安全沙龙视频 [地址](https://space.bilibili.com/503330419)\n\n### 7 证书\n\n* AWS 安全认证-专业 AWS Certified Security - Specialty [地址](https://aws.amazon.com/certification/certified-security-specialty/)\n* AWS 认证解决方案架构师-助理 AWS Certified Solutions Architect – Associate [地址](https://aws.amazon.com/cn/certification/certified-solutions-architect-associate/)\n* Azure 基础知识认证 Azure Fundamentals [地址](https://learn.microsoft.com/certifications/azure-fundamentals/)\n* Azure 安全工程师助理 Azure Security Engineer Associate [地址](https://learn.microsoft.com/certifications/azure-security-engineer/)\n* CompTIA Cloud+ [地址](https://www.comptia.org/certifications/cloud)\n* GCP 专业云安全工程师 GCP Professional Cloud Security Engineer [地址](https://cloud.google.com/learn/certification/cloud-security-engineer)\n* GCP 云工程师助理 Associate Cloud Engineer [地址](https://cloud.google.com/learn/certification/cloud-engineer)\n* Kubernetes 认证安全专家 Certified Kubernetes Security Specialist (CKS) [地址](https://training.linuxfoundation.org/certification/certified-kubernetes-security-specialist/)\n* 认证云安全专家 Certified Cloud Security Professional (CCSP) [地址](https://www.isc2.org/Certifications/CCSP)\n* 阿里云专业工程师 Alibaba Cloud Certified Professional (ACP) [地址](https://edu.aliyun.com/certification)\n* 阿里云云计算架构师 Alibaba Cloud Certified Expert - Cloud Computing (ACE) [地址](https://edu.aliyun.com/certification/ace01)\n* 阿里云助理工程师 Alibaba Cloud Certified Associate (ACA) [地址](https://edu.aliyun.com/certification)\n\n### 8 云服务文章\n\n**综合**\n\n* 浅谈云上攻防——云服务器攻防矩阵 [地址](https://cloud.tencent.com/developer/article/1931560)\n* 浅谈云上攻防——对象存储服务访问策略评估机制研究 [地址](https://mp.weixin.qq.com/s/ncWGrMsIAvh9HEK1QC5IGQ)\n* 红队视角下的公有云基础组件安全 [地址](https://mp.weixin.qq.com/s/r0DuASP6gH_48b5sJ1DCTw)\n* 红队视角下的公有云基础组件安全（二）[地址](https://mp.weixin.qq.com/s/lL32lywlrnuyhJkQk5NAEw)\n* 公有云 IP 重用的威胁和防御方法分析 Paper（英文）[地址](https://arxiv.org/pdf/2204.05122.pdf)\n* 企业迁移到公有云之前要问的5个问题 [地址](http://www.d1net.com/cloud/news/574569.html)\n* 云上攻防：RED TEAMING FOR CLOUD [地址](http://avfisher.win/archives/1175)\n* 云上攻防二三事（续）[地址](http://avfisher.win/archives/1331)\n* 云计算隔离问题：PostgreSQL 的漏洞影响到多个云计算供应商（英文）[地址](https://www.wiz.io/blog/the-cloud-has-an-isolation-problem-postgresql-vulnerabilities)\n* 常规云服务业务侧攻防视角研究 [地址](https://mp.weixin.qq.com/s/2yaQ_W5K7BfmycMO2UcXJg)\n* 云安全学习建议与方向（英文）[地址](https://www.nojones.net/posts/breaking-into-cloudsec)\n* 60 种云攻击的方法（英文）[地址](https://redteamrecipe.com/60-methods-for-cloud-attacksrtc0009) `由「程皮糖别皮」师傅补充，感谢支持`\n* 云服务安全漏洞汇总 [地址](https://github.com/hashishrajan/cloud-security-vulnerabilities) ![GitHub stars](https://img.shields.io/github/stars/hashishrajan/cloud-security-vulnerabilities)\n* Lightspin 2022 年 7 大云攻击路径（英文） [地址](https://github.com/lightspin-tech/lightspin-2022-top-7-attack-paths) ![GitHub stars](https://img.shields.io/github/stars/lightspin-tech/lightspin-2022-top-7-attack-paths)\n\n**AWS**\n\n* AWS S3 对象存储攻防 [地址](https://zone.huoxian.cn/d/907-aws-s3)\n* AWS EC2 弹性计算服务攻防 [地址](https://zone.huoxian.cn/d/1022-aws-ec2)\n* 针对 AWS Lambda 的运行时攻击 [地址](https://mp.weixin.qq.com/s/duF1Z0EDC3n_G378Aq_XYA)\n* 利用 AWS RDS 读取实例凭证（英文）[地址](https://blog.lightspin.io/aws-rds-critical-security-vulnerability)\n* 利用 AWS RDS 读取实例凭证（中文翻译）[地址](https://zone.huoxian.cn/d/1141-aws-rdsaws)\n* 风险最高的 10 种 AWS 配置错误 [地址](https://mp.weixin.qq.com/s/quIpapbkFNay0JtUK4wODQ)\n* 在 AWS 下查看自己所拥有的权限 [地址](https://wiki.teamssix.com/CloudService/IAM/list-attached-user-policies.html)\n* AWS 枚举（第一部分）（英文）[地址](https://securitycafe.ro/2022/11/01/aws-enumeration-part-1/)\n* 当 0day 和访问密钥在云上被结合利用时：应对 SugarCRM 0day 漏洞 (英文) [地址](https://unit42.paloaltonetworks.com/sugarcrm-cloud-incident-black-hat/)\n* 利用 AWS 官方对 log4j 漏洞的热补丁实现容器逃逸（英文）[地址](https://unit42.paloaltonetworks.com/aws-log4shell-hot-patch-vulnerabilities/)\n* AWS 创建后门的几种方法（英文）[地址](https://mystic0x1.github.io/posts/methods-to-backdoor-an-aws-account)\n* AWS 权限提升（英文）[地址](https://github.com/RhinoSecurityLabs/AWS-IAM-Privilege-Escalation) ![GitHub stars](https://img.shields.io/github/stars/RhinoSecurityLabs/AWS-IAM-Privilege-Escalation)\n\n**Azure**\n\n* 微软云 对象存储攻防 [地址](https://zone.huoxian.cn/d/940)\n* 微软云 VM 攻防 [地址](https://zone.huoxian.cn/d/1083-vm)\n* Azure Cloud Shell 命令注入窃取用户的访问令牌（英文）[地址](https://blog.lightspin.io/azure-cloud-shell-command-injection-stealing-users-access-tokens)\n* Azure 资源收集项目 Awesome-Azure-Pentest [地址](https://github.com/Kyuu-Ji/Awesome-Azure-Pentest) ![GitHub stars](https://img.shields.io/github/stars/Kyuu-Ji/Awesome-Azure-Pentest) `由「橘子怪」师傅补充，感谢支持`\n\n**GCP**\n\n* 谷歌云 对象存储攻防 [地址](https://zone.huoxian.cn/d/931)\n* 谷歌云 Compute Engine 攻防 [地址](https://zone.huoxian.cn/d/1043-compute-engine)\n* Google Cloud Shell 命令注入（英文）[地址](https://bugra.ninja/posts/cloudshell-command-injection)\n* GCP 渗透测试笔记（英文）[地址](https://0xd4y.com/2022/10/01/GCP-Penetration-Testing-Notes/)\n\n**阿里云**\n\n* 阿里云 OSS 对象存储攻防 [地址](https://zone.huoxian.cn/d/918-oss)\n* 阿里云 ECS 攻防 [地址](https://zone.huoxian.cn/d/1064-ecs)\n* 从云服务器 SSRF 漏洞到接管你的阿里云控制台 [地址](https://wiki.teamssix.com/CloudService/EC2/aliyun-console-takeover.html)\n* 我用 CF 打穿了他的云上内网 [地址](https://zone.huoxian.cn/d/1341-cf)\n* 记录一次平平无奇的云上攻防过程 [地址](https://zone.huoxian.cn/d/2557)\n* 一次简单的\"云\"上野战记录 [地址](https://mp.weixin.qq.com/s/wi8CoNwdpfJa6eMP4t1PCQ)\n* 记一次打穿云上内网的攻防实战 [地址](https://zone.huoxian.cn/d/2766)\n\n**腾讯云**\n\n* 腾讯云 COS 对象存储攻防 [地址](https://zone.huoxian.cn/d/949-cos)\n* 腾讯云服务器攻防（CVM+轻量应用服务器）[地址](https://zone.huoxian.cn/d/1028-cvm)\n\n**华为云**\n\n* 华为云 OBS 对象存储攻防 [地址](https://zone.huoxian.cn/d/962-obs)\n* 华为云 ECS 弹性云服务器攻防 [地址](https://zone.huoxian.cn/d/1074-ecs)\n* 华为云 CTF cloud 非预期解之 k8s 渗透实战 [地址](https://annevi.cn/2020/12/21/%E5%8D%8E%E4%B8%BA%E4%BA%91ctf-cloud%E9%9D%9E%E9%A2%84%E6%9C%9F%E8%A7%A3%E4%B9%8Bk8s%E6%B8%97%E9%80%8F%E5%AE%9E%E6%88%98/)\n\n### 9 云原生文章\n\n**综合**\n\n* 红蓝对抗中的云原生漏洞挖掘及利用实录 [地址](https://security.tencent.com/index.php/blog/msg/183)\n* CIS 基准检测手册（英文） [地址](https://www.cisecurity.org/benchmark/kubernetes) `由「zhengjim」师傅补充，感谢支持`\n* 浅谈 Linux Cgroup 机制 [地址](https://zhuanlan.zhihu.com/p/81668069)  `由「zxynull」师傅补充，感谢支持`\n* 保障云和容器安全的十个注意事项（英文）[地址](https://sysdig.com/blog/considerations-securing-cloud-containers/)\n* CNCF 云原生安全白皮书 v2 [地址](https://github.com/cncf/tag-security/tree/main/security-whitepaper/v2)\n* awesome-cloud-native-security from Metarget [地址](https://github.com/Metarget/awesome-cloud-native-security) ![GitHub stars](https://img.shields.io/github/stars/Metarget/awesome-cloud-native-security)\n\n**Docker**\n\n* 特权模式下 Docker 逃逸手法总结 [地址](https://zone.huoxian.cn/d/1071-docker)\n* 容器逃逸方法检测指北（附检测脚本）[地址](https://zone.huoxian.cn/d/990)\n* Docker 核心技术与实现原理 [地址](https://draveness.me/docker/)  `由「zxynull」师傅补充，感谢支持`\n* 容器安全清单 container-security-checklist [地址](https://github.com/krol3/container-security-checklist) ![GitHub stars](https://img.shields.io/github/stars/krol3/container-security-checklist) `由「zxynull」师傅补充，感谢支持`\n\n**Kubernetes**\n\n* 利用 gateway-api，我支配了 kubernetes [地址](https://mp.weixin.qq.com/s/Y4F72s0JSyvjLBN3iNyUZg)\n* 浅析 k8s 各种未授权攻击方法 [地址](https://zone.huoxian.cn/d/1153-k8s)\n* 云原生之 Kubernetes 安全 [地址](https://forum.butian.net/share/1095)\n* RCE 进入内网接管 K8s 并逃逸进 xx 网 [地址](https://mp.weixin.qq.com/s/UvjKHaVzhluc22trF46uBA)\n* 从零开始的 Kubernetes 攻防 [地址](https://github.com/neargle/my-re0-k8s-security) ![GitHub stars](https://img.shields.io/github/stars/neargle/my-re0-k8s-security)\n\n**eBPF**\n\n* 使用 eBPF 逃逸容器技术分析与实践 [地址 ](https://security.tencent.com/index.php/blog/msg/206) `由「zxynull」师傅补充，感谢支持`\n* 内核态 eBPF 程序实现容器逃逸与隐藏账号rootkit [地址 ](https://www.cnxct.com/container-escape-in-linux-kernel-space-by-ebpf/?f=wb\u0026continueFlag=0ba98c50fdecece390192b7dd4adf11d) `由「zxynull」师傅补充，感谢支持`\n* 基于 eBPF 实现容器运行时安全 [地址](https://www.ebpf.top/post/ebpf_container_security/)  `由「zxynull」师傅补充，感谢支持`\n* 初探 eBPF [地址](https://mp.weixin.qq.com/s/GvWKY4M5YvorC4JF2ztUvQ)\n\n**Terraform**\n\n* Terraform 中文教程 [地址](https://lonegunmanb.github.io/introduction-terraform/)\n* Terraform 使用入门以及在云上攻防中的作用 [地址](https://wiki.teamssix.com/CloudNative/Terraform/terraform-introductory.html)\n\n**APISIX**\n\n* APISIX CVE-2022-29266 漏洞分析与复现 [地址](https://mp.weixin.qq.com/s/Un-9y_UhWDw9svHKb-JQVQ)\n\n**CI/CD**\n\n* CI/CD 攻击场景 - KCon 2023 议题 [地址](https://github.com/knownsec/KCon/blob/master/2023/CICD%E6%94%BB%E5%87%BB%E5%9C%BA%E6%99%AF.pdf) `由「宅独青年」师傅补充，感谢支持`\n\n## 0x02 工具 :hammer_and_wrench:\n\n### 1 云服务工具\n\n#### 辅助工具\n\n\u003cbr\u003e\n\n**综合**\n\n* 在线搜索目标网站下的云资产 recon.cloud [地址](https://recon.cloud/)\n* 在线多云管理平台 行云管家 [地址](https://www.cloudbility.com/) `由「半人间丶」师傅补充，感谢支持`\n* AK 等敏感信息查找工具 trufflehog [地址](https://github.com/trufflesecurity/trufflehog) ![GitHub stars](https://img.shields.io/github/stars/trufflesecurity/trufflehog)\n* 多云基线扫描工具 ScoutSuite [地址](https://github.com/nccgroup/ScoutSuite) ![GitHub stars](https://img.shields.io/github/stars/nccgroup/ScoutSuite)\n* 云安全态势管理工具 CloudSploit [地址](https://github.com/aquasecurity/cloudsploit) ![GitHub stars](https://img.shields.io/github/stars/aquasecurity/cloudsploit) `由「da Vinci【达文西】」师傅补充，感谢支持`\n* 基础设施关系绘制工具 Cartography [地址](https://github.com/lyft/cartography) ![GitHub stars](https://img.shields.io/github/stars/lyft/cartography)\n* 多云对象存储管理工具 qiniuClient [地址](https://github.com/willnewii/qiniuClient) ![GitHub stars](https://img.shields.io/github/stars/willnewii/qiniuClient) `由「半人间丶」师傅补充，感谢支持`\n* 云渗透信息收集工具 cloudfox [地址](https://github.com/BishopFox/cloudfox) ![GitHub stars](https://img.shields.io/github/stars/BishopFox/cloudfox)\n* 云服务资源枚举工具 cloud_enum [地址](https://github.com/initstring/cloud_enum) ![GitHub stars](https://img.shields.io/github/stars/initstring/cloud_enum)\n* 开源多云安全合规扫描平台 RiskScanner [地址](https://github.com/riskscanner/riskscanner) ![GitHub stars](https://img.shields.io/github/stars/riskscanner/riskscanner) `由「想走安全的小白」师傅补充，感谢支持`\n* 多云对象存储扫描工具 Cloud-Bucket-Leak-Detection-Tools [地址](https://github.com/UzJu/Cloud-Bucket-Leak-Detection-Tools) ![GitHub stars](https://img.shields.io/github/stars/UzJu/Cloud-Bucket-Leak-Detection-Tools)\n* 适用于 AWS 和 Azure 的扫描工具 SkyArk [地址](https://github.com/cyberark/SkyArk) ![GitHub stars](https://img.shields.io/github/stars/cyberark/SkyArk)\n* 云上公开资产枚举 CloudBrute [地址](https://github.com/0xsha/CloudBrute) ![GitHub stars](https://img.shields.io/github/stars/0xsha/CloudBrute)\n* 多云资产收集工具 cloudlist [地址](https://github.com/projectdiscovery/cloudlist) ![GitHub stars](https://img.shields.io/github/stars/projectdiscovery/cloudlist) `由「Kfzz1」师傅补充，感谢支持`\n* 权限升级路径分析工具 PurplePanda [地址](https://github.com/carlospolop/PurplePanda) ![GitHub stars](https://img.shields.io/github/stars/carlospolop/PurplePanda)\n* 云上攻击模拟工具 Leonidas [地址](https://github.com/WithSecureLabs/leonidas) ![GitHub stars](https://img.shields.io/github/stars/WithSecureLabs/leonidas)\n* 开源的轻量级云管平台 CloudExplorer Lite [地址](https://github.com/CloudExplorer-Dev/CloudExplorer-Lite) ![GitHub stars](https://img.shields.io/github/stars/CloudExplorer-Dev/CloudExplorer-Lite)\n* 红队云操作系统 RedCloudOS [地址](https://github.com/RedTeamOperations/RedCloud-OS) ![GitHub stars](https://img.shields.io/github/stars/RedTeamOperations/RedCloud-OS)\n* 云资产管理工具 cloudTools [地址](https://github.com/dark-kingA/cloudTools) ![GitHub stars](https://img.shields.io/github/stars/dark-kingA/cloudTools) `由「弱鸡」师傅补充，感谢支持`\n* 云服务枚举工具 cloud service enum [地址](https://github.com/NotSoSecure/cloud-service-enum) ![GitHub stars](https://img.shields.io/github/stars/NotSoSecure/cloud-service-enum)\n\n**AWS**\n\n* 在线搜索公开的存储桶 buckets.grayhatwarfare.com [地址](https://buckets.grayhatwarfare.com/)\n* AWS 文档 GPT 工具 [地址](https://www.awsdocsgpt.com)\n* AWS S3 浏览器 S3 Browser [地址](https://s3browser.com) `由「Poker」师傅补充，感谢支持`\n* 本地 AWS 环境部署工具 LocalStack [地址](https://github.com/localstack/localstack) ![GitHub stars](https://img.shields.io/github/stars/localstack/localstack) `由「Esonhugh」师傅补充，感谢支持`\n* AWS 官方 CLI 工具 [地址](https://github.com/aws/aws-cli) ![GitHub stars](https://img.shields.io/github/stars/aws/aws-cli)\n* AWS 环境分析工具 CloudMapper [地址](https://github.com/duo-labs/cloudmapper) ![GitHub stars](https://img.shields.io/github/stars/duo-labs/cloudmapper)\n* S3 策略扫描工具 S3Scanner [地址](https://github.com/sa7mon/S3Scanner) ![GitHub stars](https://img.shields.io/github/stars/sa7mon/S3Scanner)\n* AWS IAM 权限枚举工具 Principal Mapper [地址](https://github.com/nccgroup/PMapper) ![GitHub stars](https://img.shields.io/github/stars/nccgroup/PMapper)\n* AWS IAM 权限枚举工具 enumerate-iam [地址](https://github.com/andresriancho/enumerate-iam)  ![GitHub stars](https://img.shields.io/github/stars/andresriancho/enumerate-iam)\n* S3 公开存储桶密钥扫描工具 S3cret Scanner [地址](https://github.com/Eilonh/s3crets_scanner) ![GitHub stars](https://img.shields.io/github/stars/Eilonh/s3crets_scanner)\n* AWS 常见配置错误审计工具 YATAS [地址](https://github.com/padok-team/yatas) ![GitHub stars](https://img.shields.io/github/stars/padok-team/yatas)\n* 检测多云环境中存在 dangling DNS 记录的工具 findmytakeover [地址](https://github.com/anirudhbiyani/findmytakeover) ![GitHub stars](https://img.shields.io/github/stars/anirudhbiyani/findmytakeover)\n* Route53/CloudFront 漏洞评估工具 [地址](https://github.com/prevade/cloudjack) ![GitHub stars](https://img.shields.io/github/stars/prevade/cloudjack)\n* CloudTrail 日志分析 IAM 权限工具 Cloudtrail2IAM [地址](https://github.com/carlospolop/Cloudtrail2IAM) ![GitHub stars](https://img.shields.io/github/stars/carlospolop/Cloudtrail2IAM)\n\n**Azure**\n\n* Azure 官方 CLI 工具 [地址](https://github.com/Azure/azure-cli) ![GitHub stars](https://img.shields.io/github/stars/Azure/azure-cli)\n* Azure MFA 检测工具 [地址](https://github.com/dafthack/MFASweep) ![GitHub stars](https://img.shields.io/github/stars/dafthack/MFASweep)\n* Azure AD 和 Office 365 的 PowerShell 管理模块 AADInternals [地址](https://github.com/Gerenios/AADInternals) ![GitHub stars](https://img.shields.io/github/stars/Gerenios/AADInternals)\n* BloodHound 收集 Azure 数据工具 AzureHound [地址](https://github.com/BloodHoundAD/AzureHound) ![GitHub stars](https://img.shields.io/github/stars/BloodHoundAD/AzureHound) `由「Kfzz1」师傅补充，感谢支持`\n* Azure AD 信息收集工具 AzureGraph [地址](https://github.com/JoelGMSec/AzureGraph) ![GitHub stars](https://img.shields.io/github/stars/JoelGMSec/AzureGraph) `由「Kfzz1」师傅补充，感谢支持`\n\n**GCP**\n\n* GCP 官方 CLI 工具 [地址](https://cloud.google.com/sdk/gcloud/)\n* GCP 资源枚举工具 [地址](https://gitlab.com/gitlab-com/gl-security/threatmanagement/redteam/redteam-public/gcp_enum)\n* GCP 攻击面资源枚举工具 [地址](https://gitlab.com/gitlab-com/gl-security/threatmanagement/redteam/redteam-public/gcp_firewall_enum)\n* GCP 资源分析工具 Hayat [地址](https://github.com/DenizParlak/hayat) ![GitHub stars](https://img.shields.io/github/stars/DenizParlak/hayat)\n* GCP IAM 权限收集工具 gcp-iam-collector [地址](https://github.com/marcin-kolda/gcp-iam-collector) ![GitHub stars](https://img.shields.io/github/stars/marcin-kolda/gcp-iam-collector)\n* Google Workspace 目录转储工具 Google Workspace Directory Dump Tool [地址](https://github.com/RedTeamOperations/GoogleWorkspaceDirectoryDump) ![GitHub stars](https://img.shields.io/github/stars/RedTeamOperations/GoogleWorkspaceDirectoryDump)\n\n**阿里云**\n\n* 阿里云官方 OSS 管理工具 [地址](https://github.com/aliyun/oss-browser) ![GitHub stars](https://img.shields.io/github/stars/aliyun/oss-browser) `由「半人间丶」师傅补充，感谢支持`\n* 阿里云官方 CLI 工具 [地址](https://github.com/aliyun/aliyun-cli) ![GitHub stars](https://img.shields.io/github/stars/aliyun/aliyun-cli)\n\n**腾讯云**\n\n* 腾讯云轻量服务器管理工具 [地址](https://www.qqvps.com/d/1011) `由「tanger」师傅补充，感谢支持`\n* 腾讯云官方 COS 辅助工具 [地址](https://cosbrowser.cloud.tencent.com/) `由「Esonhugh」师傅补充，感谢支持`\n* 腾讯云官方 CLI 工具 [地址](https://github.com/TencentCloud/tencentcloud-cli) ![GitHub stars](https://img.shields.io/github/stars/TencentCloud/tencentcloud-cli)\n\n**华为云**\n\n* 华为云 OBS 官方管理工具 OBS Browser+ [地址](https://support.huaweicloud.com/browsertg-obs/obs_03_1003.html)\n\n**天翼云**\n\n* 天翼云对象存储连接工具 [地址](https://www.ctyun.cn/document/10000101/10006768)\n\n**青云**\n\n* 青云官方 CLI 工具 [地址](https://docsv4.qingcloud.com/user_guide/development_docs/cli/install/install) `由 「苏打养乐多」师傅补充，感谢支持`\n\n#### 利用工具\n\n\u003cbr\u003e\n\n**多云**\n\n* 阿里云/腾讯云 AK 资源管理工具 [地址](https://github.com/wyzxxz/aksk_tool) ![Github stars](https://img.shields.io/github/stars/wyzxxz/aksk_tool) `由「Esonhugh」师傅补充，感谢支持`\n* 支持 GUI 的 AWS、GCP 利用工具 Vajra [地址](https://github.com/TROUBLE-1/Vajra) ![Github stars](https://img.shields.io/github/stars/TROUBLE-1/Vajra) `由「Kfzz1」师傅补充，感谢支持`\n\n**AWS**\n\n* AWS 综合利用工具 pacu [地址](https://github.com/RhinoSecurityLabs/pacu) ![GitHub stars](https://img.shields.io/github/stars/RhinoSecurityLabs/pacu)\n* AWS 渗透工具集 aws-pentest-tools [地址](https://github.com/RhinoSecurityLabs/Security-Research/tree/master/tools/aws-pentest-tools) ![GitHub stars](https://img.shields.io/github/stars/RhinoSecurityLabs/Security-Research)\n* AWS Lambda 密码喷洒工具 CredKing [地址](https://github.com/ustayready/CredKing) ![GitHub stars](https://img.shields.io/github/stars/ustayready/CredKing)\n* AWS AccessKey 泄漏利用工具 awsKeyTools [地址](https://github.com/Aabyss-Team/awsKeyTools)  ![GitHub stars](https://img.shields.io/github/stars/Aabyss-Team/awsKeyTools) `由「1derian」和「ShangRui-hash」师傅联合补充，感谢支持`\n* AWS 渗透测试工具 Endgame [地址](https://github.com/DavidDikker/endgame) ![GitHub stars](https://img.shields.io/github/stars/DavidDikker/endgame)\n* AWS 控制台接管利用工具 aws_consoler [地址](https://github.com/NetSPI/aws_consoler) ![GitHub stars](https://img.shields.io/github/stars/NetSPI/aws_consoler)\n* AWS 红队利用脚本 Redboto [地址](https://github.com/ihamburglar/Redboto) ![GitHub stars](https://img.shields.io/github/stars/ihamburglar/Redboto)\n* AWS 域控卷影拷贝工具 CloudCopy [地址](https://github.com/Static-Flow/CloudCopy) ![GitHub stars](https://img.shields.io/github/stars/Static-Flow/CloudCopy)\n\n**Azure**\n\n* Azure 安全评估 PowerShell 工具包 MicroBurst [地址](https://github.com/NetSPI/MicroBurst) ![GitHub stars](https://img.shields.io/github/stars/NetSPI/MicroBurst)\n* Azure 红队利用工具 Stormspotter [地址](https://github.com/Azure/Stormspotter) ![GitHub stars](https://img.shields.io/github/stars/Azure/Stormspotter) `由「da Vinci【达文西】」师傅补充，感谢支持`\n* Azure AD 利用工具集 ROADtools [地址](https://github.com/dirkjanm/ROADtools) ![GitHub stars](https://img.shields.io/github/stars/dirkjanm/ROADtools)\n* 枚举、喷洒、渗透 O365 AAD 帐户工具 TeamFiltration [地址](https://github.com/Flangvik/TeamFiltration) ![GitHub stars](https://img.shields.io/github/stars/Flangvik/TeamFiltration)\n* Azure JWT 令牌操作工具集 TokenTactics [地址](https://github.com/rvrsh3ll/TokenTactics) ![GitHub stars](https://img.shields.io/github/stars/rvrsh3ll/TokenTactics)\n* Microsoft 365 安全工具箱 DCToolbox [地址](https://github.com/DanielChronlund/DCToolbox) ![GitHub stars](https://img.shields.io/github/stars/DanielChronlund/DCToolbox)\n* 滥用 Microsoft 365 OAuth 授权流程进行网络钓鱼攻击的概念验证脚本 Microsoft365_devicePhish [地址](https://github.com/optiv/Microsoft365_devicePhish) ![GitHub stars](https://img.shields.io/github/stars/optiv/Microsoft365_devicePhish)\n* Azure AD 身份保护 Cookie 重放测试工具 [地址](https://github.com/jsa2/aadcookiespoof) ![GitHub stars](https://img.shields.io/github/stars/jsa2/aadcookiespoof)\n* 用于攻击 Azure Function 应用程序的 PowerShell 工具 FuncoPop [地址](https://github.com/NetSPI/FuncoPop) ![GitHub stars](https://img.shields.io/github/stars/NetSPI/FuncoPop)\n\n**GCP**\n\n* GCP 利用工具集 [地址](https://gitlab.com/gitlab-com/gl-security/threatmanagement/redteam/redteam-public/gcp_misc)\n* GCP Bucket 枚举工具 GCPBucketBrute [地址](https://github.com/RhinoSecurityLabs/GCPBucketBrute) ![GitHub stars](https://img.shields.io/github/stars/RhinoSecurityLabs/GCPBucketBrute)\n* GCP IAM 权限提升方法 GCP-IAM-Privilege-Escalation [地址](https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation) ![GitHub stars](https://img.shields.io/github/stars/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation) `由「da Vinci【达文西】」师傅补充，感谢支持`\n* GCP Token 复用工具 [地址](https://github.com/RedTeamOperations/GCPTokenReuse) ![GitHub stars](https://img.shields.io/github/stars/RedTeamOperations/GCPTokenReuse)\n\n**Google Workspace**\n\n* Simple Workspace ATT\u0026CK Tool - SWAT [地址](https://github.com/elastic/SWAT) ![GitHub stars](https://img.shields.io/github/stars/elastic/SWAT)\n\n**阿里云**\n\n* 阿里云 AccessKey 利用工具 aliyun-accesskey-Tools [地址](https://github.com/mrknow001/aliyun-accesskey-Tools) ![GitHub stars](https://img.shields.io/github/stars/mrknow001/aliyun-accesskey-Tools) `由「半人间丶」师傅补充，感谢支持`\n* 阿里云 ECS、策略组辅助小工具 alicloud-tools [地址](https://github.com/iiiusky/alicloud-tools) ![GitHub stars](https://img.shields.io/github/stars/iiiusky/alicloud-tools) `由「半人间丶」师傅补充，感谢支持`\n* 阿里云 AccessKey 泄漏利用工具 AliyunAccessKeyTools [地址](https://github.com/NS-Sp4ce/AliyunAccessKeyTools) ![GitHub stars](https://img.shields.io/github/stars/NS-Sp4ce/AliyunAccessKeyTools) `由「半人间丶」师傅补充，感谢支持`\n\n**腾讯云**\n\n* 腾讯云 AccessKey 利用工具 Tencent_Yun_tools [地址](https://github.com/freeFV/Tencent_Yun_tools) ![GitHub stars](https://img.shields.io/github/stars/freeFV/Tencent_Yun_tools)\n\n\n### 2 云原生工具\n\n#### 辅助工具\n\n\u003cbr\u003e\n\n**综合**\n\n* 开源的云原生安全平台 HummerRisk [地址](https://github.com/HummerRisk/HummerRisk) ![GitHub stars](https://img.shields.io/github/stars/HummerRisk/HummerRisk) `由「Ma1tobiose」师傅补充，感谢支持`\n* 开源云原生安全防护平台 neuvector [地址](https://github.com/neuvector/neuvector) ![GitHub stars](https://img.shields.io/github/stars/neuvector/neuvector) `由「Idle Life」师傅补充，感谢支持`\n\n**Docker**\n\n* 一个支持在线分析容器镜像的网站 contains [地址](https://contains.dev/) `由「zxynull」师傅补充，感谢支持`\n* 容器镜像分析工具 DIVE [地址](https://github.com/wagoodman/dive) ![GitHub stars](https://img.shields.io/github/stars/wagoodman/dive) `由「zxynull」师傅补充，感谢支持`\n* 镜像扫描工具 trivy [地址](https://github.com/aquasecurity/trivy) ![GitHub stars](https://img.shields.io/github/stars/aquasecurity/trivy) `由「zxynull」师傅补充，感谢支持`\n* 容器镜像漏洞静态扫描工具 Clair [地址](https://github.com/quay/clair) ![GitHub stars](https://img.shields.io/github/stars/quay/clair) `由「zxynull」师傅补充，感谢支持`\n* 检查生产环境中部署容器的最佳实践 Docker_Bench_Security [地址](https://github.com/docker/docker-bench-security) ![GitHub stars](https://img.shields.io/github/stars/docker/docker-bench-security) `由「zxynull」师傅补充，感谢支持`\n* 原生支持容器的系统可见性工具 sysdig [地址](https://github.com/draios/sysdig) ![GitHub stars](https://img.shields.io/github/stars/draios/sysdig) `由「zxynull」师傅补充，感谢支持`\n* Docker 镜像扫描工具 Anchore [地址](https://github.com/anchore/syft/) ![GitHub stars](https://img.shields.io/github/stars/anchore/syft) `由「zxynull」师傅补充，感谢支持`\n* Docker 静态分析工具 Dagda [地址](https://github.com/eliasgranderubio/dagda/) ![GitHub stars](https://img.shields.io/github/stars/eliasgranderubio/dagda) `由「zxynull」师傅补充，感谢支持`\n* 容器逃逸检测工具 container-escape-check [地址](https://github.com/teamssix/container-escape-check) ![GitHub stars](https://img.shields.io/github/stars/teamssix/container-escape-check)\n\n**Kubernetes**\n\n* 基于终端 UI 的 k8s 集群管理工具 k9s [地址](https://github.com/derailed/k9s) ![GitHub stars](https://img.shields.io/github/stars/derailed/k9s)\n* k8s 异常活动检测工具 Falco [地址](https://github.com/falcosecurity/falco) ![GitHub stars](https://img.shields.io/github/stars/falcosecurity/falco) `由「zxynull」师傅补充，感谢支持`\n* CIS 基准检测工具 kube bench [地址](https://github.com/aquasecurity/kube-bench)  ![GitHub stars](https://img.shields.io/github/stars/aquasecurity/kube-bench) `由「zhengjim」师傅补充，感谢支持`\n* k8s 集群安全漏洞发现工具 kube hunter [地址](https://github.com/aquasecurity/kube-hunter)  ![GitHub stars](https://img.shields.io/github/stars/aquasecurity/kube-hunter) `由「zhengjim」师傅补充，感谢支持`\n* k8s 集群风险权限扫描工具 KubiScan [地址](https://github.com/cyberark/KubiScan) ![GitHub stars](https://img.shields.io/github/stars/cyberark/KubiScan) `由「UzJu」师傅补充，感谢支持`\n* k8s 安全风险检测工具 StackRox [地址](https://github.com/stackrox/stackrox) [工具介绍](https://www.stackrox.io/blog/open-source-stackrox-is-now-available/) ![GitHub stars](https://img.shields.io/github/stars/stackrox/stackrox) `由「m4d3bug」师傅补充，感谢支持`\n* k8s 安全审计工具 kubestriker [地址](https://github.com/vchinnipilli/kubestriker) ![GitHub stars](https://img.shields.io/github/stars/vchinnipilli/kubestriker) `由「zhengjim」师傅补充，感谢支持`\n* 基于 kubectl 的红队 k8s 安全评估工具 red kube [地址](https://github.com/lightspin-tech/red-kube) ![GitHub stars](https://img.shields.io/github/stars/lightspin-tech/red-kube) `由「zhengjim」师傅补充，感谢支持`\n* k8s 调试辅助工具 validkube [地址](https://github.com/komodorio/validkube) ![GitHub stars](https://img.shields.io/github/stars/komodorio/validkube)\n\n**Terraform**\n\n* Terraform 可视化 [地址](https://github.com/hieven/terraform-visual) ![GitHub stars](https://img.shields.io/github/stars/hieven/terraform-visual)\n\n\n#### 利用工具\n\n* 容器渗透工具集 CDK [地址](https://github.com/cdk-team/CDK) ![GitHub stars](https://img.shields.io/github/stars/cdk-team/CDK)\n* 容器安全工具集 veinmind-tools [地址](https://github.com/chaitin/veinmind-tools) ![GitHub stars](https://img.shields.io/github/stars/chaitin/veinmind-tools)\n* k8s 渗透测试工具 Peirates [地址](https://github.com/inguardians/peirates) ![GitHub stars](https://img.shields.io/github/stars/inguardians/peirates) `由「Idle Life」师傅补充，感谢支持`\n* 容器渗透测试工具 BOtB [地址](https://github.com/brompwnie/botb) ![GitHub stars](https://img.shields.io/github/stars/brompwnie/botb) `由「Idle Life」师傅补充，感谢支持`\n* 容器利用工具 CCAT [地址](https://github.com/RhinoSecurityLabs/ccat) ![GitHub stars](https://img.shields.io/github/stars/RhinoSecurityLabs/ccat) `由「zhengjim」师傅补充，感谢支持`\n\n## 0x03 靶场 :dart:\n\n### 云服务靶场\n\n* 在线收费的包含云安全实验的靶场 Attack Defense [地址](https://attackdefense.pentesteracademy.com/listing?labtype=cloud-services\u0026subtype=cloud-services-amazon-s3)\n* 在线免费的 AWS 渗透测试靶场 Free AWS Security Labs [地址](https://pentesting.cloud/) `由「cr」师傅补充，感谢支持`\n* 在线多云渗透靶场 pwnedlabs [地址](https://pwnedlabs.io) `由「RBPi」师傅补充，感谢支持`\n* AWS 靶场部署工具 cloudgoat [地址](https://github.com/RhinoSecurityLabs/cloudgoat) ![GitHub stars](https://img.shields.io/github/stars/RhinoSecurityLabs/cloudgoat)\n* AWS 靶场 AWSGoat [地址](https://github.com/ine-labs/AWSGoat) ![GitHub stars](https://img.shields.io/github/stars/ine-labs/AWSGoat)\n* Azure 靶场  AzureGoat [地址](https://github.com/ine-labs/AzureGoat) ![GitHub stars](https://img.shields.io/github/stars/ine-labs/AzureGoat) `由「Kfzz1」师傅补充，感谢支持`\n* 多云靶场搭建工具 TerraformGoat  [地址](https://github.com/HuoCorp/TerraformGoat) ![GitHub stars](https://img.shields.io/github/stars/HuoCorp/TerraformGoat)\n* AWS IAM 靶场 IAM Vulnerable [地址](https://github.com/BishopFox/iam-vulnerable) ![GitHub stars](https://img.shields.io/github/stars/BishopFox/iam-vulnerable)\n* GCP 靶场部署工具 GCPGoat [地址](https://github.com/ine-labs/GCPGoat) ![GitHub stars](https://img.shields.io/github/stars/ine-labs/GCPGoat) `由「Kfzz1」师傅补充，感谢支持`\n\n### 云原生靶场\n\n* WIZ K8s 靶场 WIZ K8S LAN Party [地址](https://www.k8slanparty.com/) `由「feng」师傅补充，感谢支持`\n* k8s 靶场部署工具 Kubernetes Goat [地址](https://github.com/madhuakula/kubernetes-goat) ![GitHub stars](https://img.shields.io/github/stars/madhuakula/kubernetes-goat) `由「UzJu」师傅补充，感谢支持`\n* CI/CD 靶场部署工具 [地址](https://github.com/cider-security-research/cicd-goat) ![GitHub stars](https://img.shields.io/github/stars/cider-security-research/cicd-goat) `由「Kfzz1」师傅补充，感谢支持`\n* 云原生靶场部署工具 metarget [地址](https://github.com/Metarget/metarget) ![GitHub stars](https://img.shields.io/github/stars/Metarget/metarget)\n\n\n## 贡献者 :confetti_ball:\n\n感谢你们的支持 ~\n\n\u003ctable\u003e\n    \u003ctr\u003e\n        \u003ctd align=\"center\"\u003e\u003cimg alt=\"TeamsSix\" src=\"/img/1651741861.png\" style=\"width: 100px;\" /\u003e\u003cbr /\u003eTeamsSix\u003c/td\u003e\n        \u003ctd align=\"center\"\u003e\u003cimg alt=\"1derian\" src=\"/img/1650108029.png\" style=\"width: 100px;\" /\u003e\u003cbr /\u003e1derian\u003c/td\u003e\n        \u003ctd align=\"center\"\u003e\u003cimg alt=\"ShangRui-hash\" src=\"/img/1650108092.png\" style=\"width: 100px;\" /\u003e\u003cbr /\u003eShangRui-hash\u003c/td\u003e\n        \u003ctd align=\"center\"\u003e\u003cimg alt=\"半人间丶\" src=\"/img/1650108207.png\" style=\"width: 100px;\" /\u003e\u003cbr /\u003e半人间丶\u003c/td\u003e\n        \u003ctd align=\"center\"\u003e\u003cimg alt=\"UzJu\" src=\"/img/1650253985.png\" style=\"width: 100px;\" /\u003e\u003cbr /\u003eUzJu\u003c/a\u003e\n        \u003c/td\u003e\n        \u003ctd align=\"center\"\u003e\u003cimg alt=\"Idle Life\" src=\"/img/1650865577.png\" style=\"width: 100px;\" /\u003e\u003cbr /\u003eIdle Life\u003c/td\u003e\n    \u003c/tr\u003e\n    \u003ctr\u003e\n        \u003ctd align=\"center\"\u003e\u003cimg alt=\"zhengjim\" src=\"/img/1650942808.png\" style=\"width: 100px;\" /\u003e\u003cbr /\u003ezhengjim\u003c/a\u003e\n        \u003c/td\u003e\n        \u003ctd align=\"center\"\u003e\u003cimg alt=\"zxynull\" src=\"/img/1651146804.png\" style=\"width: 100px;\" /\u003e\u003cbr /\u003ezxynull\u003c/a\u003e\n        \u003c/td\u003e\n        \u003ctd align=\"center\"\u003e\u003cimg alt=\"m4d3bug\" src=\"/img/1651740464.png\" style=\"width: 100px;\" /\u003e\u003cbr /\u003em4d3bug\u003c/a\u003e\n        \u003c/td\u003e\n        \u003ctd align=\"center\"\u003e\u003cimg alt=\"da Vinci【达文西】\" src=\"/img/1651917214.png\" style=\"width: 100px;\" /\u003e\u003cbr /\u003eda Vinci【达文西】\u003c/a\u003e\n        \u003c/td\u003e\n        \u003ctd align=\"center\"\u003e\u003cimg alt=\"tanger\" src=\"/img/1653815174.png\" style=\"width: 100px;\" /\u003e\u003cbr /\u003etanger\u003c/a\u003e\n        \u003c/td\u003e\n        \u003ctd align=\"center\"\u003e\u003cimg alt=\"想走安全的小白\" src=\"/img/1654852861.png\" style=\"width: 100px;\" /\u003e\u003cbr /\u003e想走安全的小白\u003c/a\u003e\n        \u003c/td\u003e\n    \u003c/tr\u003e\n    \u003ctr\u003e\n        \u003ctd align=\"center\"\u003e\u003cimg alt=\"Esonhugh\" src=\"/img/1654854214.png\" style=\"width: 100px;\" /\u003e\u003cbr /\u003eEsonhugh\u003c/a\u003e\n        \u003c/td\u003e\n        \u003ctd align=\"center\"\u003e\u003cimg alt=\"Kfzz1\" src=\"/img/1667370152.png\" style=\"width: 100px;\" /\u003e\u003cbr /\u003eKfzz1\u003c/a\u003e\n        \u003c/td\u003e\n        \u003ctd align=\"center\"\u003e\u003cimg alt=\"cr\" src=\"/img/1684313513.png\" style=\"width: 100px;\" /\u003e\u003cbr /\u003ecr\u003c/a\u003e\n        \u003c/td\u003e\n        \u003ctd align=\"center\"\u003e\u003cimg alt=\"Ma1tobiose\" src=\"/img/1688880306.png\" style=\"width: 100px;\" /\u003e\u003cbr /\u003eMa1tobiose\u003c/a\u003e\n        \u003c/td\u003e\n        \u003ctd align=\"center\"\u003e\u003cimg alt=\"DVKunion\" src=\"/img/1689259230.png\" style=\"width: 100px;\" /\u003e\u003cbr /\u003eDVKunion\u003c/a\u003e\n        \u003c/td\u003e\n        \u003ctd align=\"center\"\u003e\u003cimg alt=\"苏打养乐多\" src=\"/img/1692362083.png\" style=\"width: 100px;\" /\u003e\u003cbr /\u003e苏打养乐多\u003c/a\u003e\n        \u003c/td\u003e\n    \u003c/tr\u003e\n    \u003ctr\u003e\n        \u003ctd align=\"center\"\u003e\u003cimg alt=\"橘子怪\" src=\"/img/1694685251.png\" style=\"width: 100px;\" /\u003e\u003cbr /\u003e橘子怪\u003c/a\u003e\n        \u003c/td\u003e\n        \u003ctd align=\"center\"\u003e\u003cimg alt=\"宅独青年\" src=\"/img/2000000016.png\" style=\"width: 100px;\" /\u003e\u003cbr /\u003e宅独青年\u003c/a\u003e\n        \u003c/td\u003e\n\t\t\t\t\u003ctd align=\"center\"\u003e\u003cimg alt=\"弱鸡\" src=\"/img/2000000017.png\" style=\"width: 100px;\" /\u003e\u003cbr /\u003e弱鸡\u003c/a\u003e\n        \u003c/td\u003e\n\t\t\t\t\u003ctd align=\"center\"\u003e\u003cimg alt=\"RBPi\" src=\"/img/2000000021.png\" style=\"width: 100px;\" /\u003e\u003cbr /\u003eRBPi\u003c/a\u003e\n        \u003c/td\u003e\n        \u003ctd align=\"center\"\u003e\u003cimg alt=\"程皮糖别皮\" src=\"/img/2000000022.png\" style=\"width: 100px;\" /\u003e\u003cbr /\u003e程皮糖别皮\u003c/a\u003e\n        \u003c/td\u003e\n        \u003ctd align=\"center\"\u003e\u003cimg alt=\"Kagantua\" src=\"/img/2000000026.png\" style=\"width: 100px;\" /\u003e\u003cbr /\u003eKagantua\u003c/a\u003e\n        \u003c/td\u003e\n    \u003c/tr\u003e\n    \u003ctr\u003e\n        \u003ctd align=\"center\"\u003e\u003cimg alt=\"feng\" src=\"/img/2000000027.png\" style=\"width: 100px;\" /\u003e\u003cbr /\u003efeng\u003c/a\u003e\n        \u003c/td\u003e\n        \u003ctd align=\"center\"\u003e\u003cimg alt=\"Poker\" src=\"/img/2000000032.png\" style=\"width: 100px;\" /\u003e\u003cbr /\u003ePoker\u003c/a\u003e\n        \u003c/td\u003e\n        \u003ctd align=\"center\"\u003e\u003cimg alt=\"Yaney\" src=\"/img/2000000040.png\" style=\"width: 100px;\" /\u003e\u003cbr /\u003eYaney\u003c/a\u003e\n        \u003c/td\u003e\n        \u003ctd align=\"center\"\u003e\u003cimg alt=\"glan\" src=\"/img/2000000043.png\" style=\"width: 100px;\" /\u003e\u003cbr /\u003eglan\u003c/a\u003e\n        \u003c/td\u003e\n    \u003c/tr\u003e\n\u003c/table\u003e\n\n### 想要一起补充？直接给本项目提 PR 或者使用右侧链接中的方法：[补充说明地址](https://wiki.teamssix.com/About/Contribute.html)\n\n## 更新日志 :calendar:\n\n在 T Wiki 云安全文库的更新日志中，记录了 Awesome Cloud Security 项目和文库的更新情况，在 [wiki.teamssix.com/Changelog](https://wiki.teamssix.com/Changelog) 这里可以查看。\n\n另外我的个人微信公众号：`TeamsSix` 欢迎你来关注\n\n\u003cdiv align=center\u003e\u003cimg width=\"700\" src=\"https://cdn.jsdelivr.net/gh/teamssix/BlogImages/imgs/202204152148071.png\" div align=center/\u003e\u003c/div\u003e\n\n\u003cdiv align=center\u003e\u003cimg src=\"https://api.star-history.com/svg?repos=teamssix/awesome-cloud-security\u0026type=Timeline\" div align=center/\u003e\u003c/div\u003e\n\n师傅都看到这了，还不点个 Star :star2: 再走吗 ~\n","projects_url":"https://awesome.ecosyste.ms/api/v1/lists/teamssix%2Fawesome-cloud-security/projects"}