Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

Awesome-Azure-Pentest

A collection of resources, tools and more for penetration testing and securing Microsofts cloud platform Azure.
https://github.com/Kyuu-Ji/Awesome-Azure-Pentest

Last synced: 1 day ago
JSON representation

Resources
Tools
- Enumeration
  - Grayhat Warfare - Open Azure blobs and AWS bucket search
  - o365creeper - Enumerate valid email addresses
  - CloudBrute - Tool to find a cloud infrastructure of a company on top Cloud providers
  - cloud_enum - Multi-cloud OSINT tool. Enumerate public resources in AWS, Azure, and Google Cloud
  - Azucar - Security auditing tool for Azure environments
  - CrowdStrike Reporting Tool for Azure (CRT) - Query Azure AD/O365 tenants for hard to find permissions and configuration settings
  - ScoutSuite - Multi-cloud security auditing tool. Security posture assessment of different cloud environments.
  - BlobHunter - A tool for scanning Azure blob storage accounts for publicly opened blobs
  - Office 365 User Enumeration - Enumerate valid usernames from Office 365 using ActiveSync, Autodiscover v1 or office.com login page
  - CloudFox - Automating situational awareness for cloud penetration tests
  - Monkey365 - Conduct Microsoft 365, Azure subscriptions and Azure Active Directory security configuration reviews
  - Azure-AccessPermissions - PowerShell script to enumerate access permissions in an Azure AD environment
  - Prowler - Perform AWS and Azure security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness
- Information Gathering
  - Get-MsolRolesAndMembers.ps1 - Retrieve list of roles and associated role members
  - o365recon - Information gathering with valid credentials to Azure
  - ROADtools - Framework to interact with Azure AD
  - PowerZure - PowerShell framework to assess Azure security
  - Azurite - Enumeration and reconnaissance activities in the Microsoft Azure Cloud
  - Sparrow.ps1 - Helps to detect possible compromised accounts and applications in the Azure/M365 environment
  - Hawk - Powershell based tool for gathering information related to O365 intrusions and potential breaches
  - Microsoft Azure AD Assessment - Tooling for assessing an Azure AD tenant state and configuration
  - Cloud Katana - Unlocking Serverless Computing to Assess Security Controls
  - SCuBA M365 Security Baseline Assessment Tool - Automation to assess the state of your M365 tenant against CISA's baselines
- Exploitation
  - azuread_decrypt_msol_v2.ps1 - Decrypt Azure AD MSOL service account
  - MicroBurst - A collection of scripts for assessing Microsoft Azure security
  - Microsoft-Teams-GIFShell - Microsoft Teams can be leveraged by an attacker, to execute a reverse shell between an attacker and victim piped through malicious GIFs sent in Teams messages
  - MSOLSpray - A password spraying tool for Microsoft Online accounts (Azure/O365)
  - MSOLSpray.py - A Python version of the MSOLSpray password spraying tool for Microsoft Online accounts (Azure/O365)
  - o365spray - Username enumeration and password spraying tool aimed at Microsoft O365
  - MFASweep - A tool for checking if MFA is enabled on multiple Microsoft Services Resources
  - adconnectdump - Dump Azure AD Connect credentials for Azure AD and Active Directory
- Lateral Movement
  - Stormspotter - Azure Red Team tool for graphing Azure and Azure Active Directory objects
  - AzureADLateralMovement - Lateral Movement graph for Azure Active Directory
  - SkyArk - Discover, assess and secure the most privileged entities in Azure and AWS
  - omigood (OM I GOOD?) - Scanner to detect VMs vulnerable to one of the "OMIGOD" vulnerabilities

Programming Languages

PowerShell 19 Python 11 HCL 2 HTML 2 Go 2 C# 1

Categories

Resources 263 Tools 35

Sub Categories

Articles 245 Enumeration 13 Information Gathering 10 Talks and Videos 9 Lab Exercises 8 Exploitation 8 Lateral Movement 4 Books 1

Keywords

security 8 azure 7 cloud 5 aws 4 powershell 4 office365 4 cloud-security 4 azuread 3 security-tools 3 pentesting 3 python 2 penetration-testing 2 azure-active-directory 2 user-enumeration 2 o365 2 m365 2 gcp 2 infosec 2 hacking 2 powershell-module 2 dfir 2 dfir-automation 2 purpleteam 2 purview 1 microsoft365-compliance 1 microsoft365 1 cis-benchmark 1 compliance 1 devsecops 1 forensics 1 gdpr 1 hardening 1 exchangeonline 1 penetration-testing-tools 1 golang 1 auditing 1 osint 1 vultr 1 s3-bucket 1 redteam 1 pentest-tool 1 linode 1 google 1 digitalocean 1 cloud-storage 1 bugbounty 1 amazon 1 admins 1 attacker 1 privileges 1