Tools

Nestori Syynimaa's PowerShell toolkit for administering, auditing and (ab)using Azure AD/Entra ID and Office 365 — used defensively to check tenant configuration and hybrid-identity exposure.

One of the original S3-bucket-name brute-forcing tools — checks a wordlist of candidate names for existence and public read access.

ruby bucket_finder.rb wordlist.txt

Lyft-originated tool that consolidates infrastructure and cloud asset relationships (AWS, GCP, GitHub, Okta, etc.) into a Neo4j graph for attack-surface and blast-radius analysis.

cartography --neo4j-uri bolt://localhost:7687

Bridgecrew/Palo Alto's static analysis scanner for infrastructure-as-code — flags insecure defaults in Terraform, CloudFormation, Kubernetes manifests, ARM and Dockerfiles before they're deployed.

checkov -d ./terraform

Open-source static vulnerability analysis for container images — the scanner behind Quay.io, indexes image layers and matches against multiple CVE feeds.

Capital One's rules engine for cloud governance — YAML policies describe the compliant state you want, and it can report, alert or automatically remediate drift across AWS/Azure/GCP.

custodian run -s output/ policy.yml

Microsoft's serverless tool for running attack simulation scenarios in Azure — executes ATT&CK-mapped techniques to validate that detections and alerts fire as expected.

Multi-cloud OSINT tool that enumerates public storage buckets, apps and resources across AWS, Azure and GCP for a given keyword or company name.

python3 cloud_enum.py -k example

Brute-forces likely bucket/storage-account names across AWS, Azure, GCP, DigitalOcean and other providers to find exposed cloud storage tied to a target company or brand.

cloudbrute -d example -k "example,exampleco" -o output.txt

Bishop Fox's situational-awareness tool for AWS, Azure and GCP — quickly maps what an account/role can do and where sensitive resources sit, used by both attackers and defenders auditing exposure.

cloudfox aws all-checks

Generates network diagrams of AWS environments from live account data, helping identify unexpected public exposure across VPCs and security groups.

python3 cloudmapper.py collect --account example

Identifies violations of least privilege in AWS IAM policies (e.g. privilege escalation, resource exposure, data exfiltration paths) and produces a browsable risk report.

cloudsplaining download\ncloudsplaining scan --input-file default.json

Cloud configuration scanner (now part of Aqua) for AWS/Azure/GCP/OCI — detects common misconfigurations across dozens of services with a plugin-based check engine.

Rotates password-spray traffic through cloud provider IPs (via FireProx-style API Gateway proxying) so login attempts against Okta/O365/OWA are not all seen from one source IP.

python3 credmaster.py -m O365 -u users.txt -p Summer2026! -s okta

Checks a Docker host and its running containers against the CIS Docker Benchmark — a fast, scripted way to see how far a host configuration is from the recommended baseline.

docker run --rm --net host --pid host --cap-add audit_control -v /var/lib:/var/lib:ro -v /var/run/docker.sock:/var/run/docker.sock:ro docker/docker-bench-security

Finds forgotten or stale IAM access keys across an AWS account — a common cloud hygiene gap and a fast win during a cloud security review.

aws iam generate-credential-report
aws iam get-credential-report --query 'Content' --output text | base64 -d

GCS exposes bucket listings over a plain JSON endpoint; a misconfigured bucket returns its full object list to an unauthenticated request.

curl -s "https://storage.googleapis.com/storage/v1/b/target-bucket/o" | jq "."

A CNCF runtime security tool for containers and Kubernetes — watches kernel syscalls against a rule set to detect unexpected process execution, privilege escalation and file access inside running workloads.

A container started with --privileged shares the full capability set of the host kernel, so code execution inside it is effectively code execution on the host.

docker ps --format '{{.ID}} {{.Names}}' | xargs -I{} docker inspect {} --format '{{.Name}}: Privileged={{.HostConfig.Privileged}}'

Cross-references bucket ACLs and policies for public access — the single most common AWS misconfiguration behind accidental data exposure.

aws s3api list-buckets --query 'Buckets[].Name' --output text | \
tr '\t' '\n' | while read b; do
  aws s3api get-bucket-policy-status --bucket "$b" --query 'PolicyStatus.IsPublic' --output text 2>/dev/null | grep -q true && echo "PUBLIC: $b"
done

NCC Group's Google Cloud Platform security auditing tool — pulls IAM, network and resource configuration and highlights common GCP misconfigurations.

Enumerates Google Cloud Storage bucket names for a target and checks the current (or anonymous) credentials for read/write/delete access on anything found.

python3 gcpbucketbrute.py -k target

Anchore's vulnerability scanner for container images and filesystems — pairs with Syft's SBOMs to give a fast, accurate CVE match against installed packages.

grype myapp:latest

Membership in the docker group is root-equivalent: mounting the host filesystem into a throwaway container gives full read and write access to it.

docker run -v /:/mnt --rm -it alpine chroot /mnt sh

Checkmarx's open-source IaC security scanner — thousands of queries across Terraform, Kubernetes, Docker, CloudFormation and more, built on the same query engine as Checkmarx's SAST.

kics scan -p ./infra -o results/

Aqua Security's tool for checking whether Kubernetes is deployed according to the CIS Kubernetes Benchmark — runs as a pod against the cluster's own components.

kube-bench run --targets node,policies

Hunts for security weaknesses in Kubernetes clusters — from inside a pod or from outside the network, probing the API server, kubelet and common misconfigurations.

kube-hunter --remote your-cluster-ip

ARMO's Kubernetes security platform — scans manifests, live clusters and container images against NSA/CISA hardening guidance, MITRE ATT&CK for containers and custom frameworks.

kubescape scan framework nsa

WithSecure's framework for testing cloud detection and response by executing ATT&CK-mapped attack techniques against AWS/Azure/GCP, driven by simple YAML test definitions.

If a bucket's ACL allows public listing, the AWS CLI enumerates it anonymously — the fastest possible bucket-exposure sanity check.

aws s3 ls s3://target-bucket-name --no-sign-request

Quick cluster-wide audit for containers that do not need to run privileged or as root but do anyway — a top item on any container hardening review.

kubectl get pods --all-namespaces -o json | jq -r '.items[] | select(.spec.containers[].securityContext.privileged==true or .spec.securityContext.runAsUser==0) | "\(.metadata.namespace)/\(.metadata.name)"'

NetSPI's PowerShell toolkit for Azure security assessment — enumerates storage accounts, key vaults, automation accounts and other Azure resources for exposed secrets and misconfigurations.

Cloud-native SIEM/SOAR on Azure — Kusto (KQL) analytics rules, hunting queries and playbooks over log data collected from Azure, on-prem and other clouds.

SecurityEvent | where EventID == 4625 | summarize count() by Account, IpAddress | order by count_ desc

Password sprays Microsoft Online (Azure AD/O365) accounts and, from the login response, distinguishes valid credentials from lockouts, MFA prompts and disabled accounts.

python3 msolspray.py --userlist users.txt --password Summer2026!

Username enumeration and password spraying against Office 365/Azure AD, supporting several login endpoints so it keeps working when Microsoft tweaks one response format.

python3 o365spray.py --validate -d corp.com

Open Policy Agent and its Kubernetes admission-controller integration, Gatekeeper — write once, enforce policy-as-code rules that reject non-compliant resources before they are ever created.

opa eval -i input.json -d policy.rego "data.k8s.deny"

Open-source AWS exploitation framework for offensive security testing of AWS environments — enumeration, privilege escalation and persistence modules against a real or lab AWS account.

pacu

Duo Labs' AWS IAM policy linter — checks policy documents for syntax errors and known bad patterns before they get attached to a role.

parliament --file policy.json

NCC Group's tool for graphing AWS IAM — identifies privilege escalation paths between IAM principals so defenders can find and fix them before an attacker does.

pmapper graph create\npmapper analysis

Kubernetes cluster sanitizer — scans live resources for misconfigurations, deprecated APIs and potential issues, reporting a per-resource 'score' rather than only security findings.

popeye

AWS (and multi-cloud) security best-practices assessment tool covering CIS benchmarks, GDPR, HIPAA and more, run as a CLI against a live account.

prowler aws

Framework for exploring and auditing Azure AD (Entra ID) — dumps the full directory into a local database, then browses/queries it offline for defensive review or misconfiguration hunting.

roadrecon gather\nroadrecon gui

Scans for open/misconfigured Amazon S3 buckets given a list of bucket-name candidates, reporting existence and public read/write access.

s3scanner scan --bucket-file bucket-names.txt

Multi-cloud security auditing tool that pulls configuration data from AWS/Azure/GCP/Alibaba via each provider's API and reports misconfigurations in a readable HTML report.

scout aws

Password-spraying tool targeting Microsoft 365 across multiple undocumented authentication endpoints, built to keep working as Microsoft changes its login flow.

spray365 spray --credential-list creds.txt

Turbot's tool that exposes cloud provider APIs as SQL tables — write plain SQL to audit AWS/Azure/GCP/Kubernetes/GitHub configuration instead of writing bespoke API scripts.

steampipe query "select name, arn from aws_s3_bucket where not block_public_acls;"

Datadog's "Atomic Red Team for the cloud" — a library of self-contained, granular attack techniques against AWS/Azure/GCP (disable CloudTrail, create an access key, assume a role) for testing whether cloud detections actually catch them.

stratus detonate aws.persistence.iam-backdoor-role

Anchore's SBOM (Software Bill of Materials) generator for container images and filesystems — the package inventory that Grype and other scanners match CVEs against.

syft myapp:latest -o cyclonedx-json

Static IaC security scanner covering Terraform, Kubernetes, Helm and CloudFormation — policy-as-code rules (OPA-based) catch misconfigurations before they reach production.

terrascan scan -i terraform -d ./infra

Cilium's eBPF-based security observability and runtime enforcement tool — real-time visibility into process execution, file and network activity with the option to block, not just alert.

Aqua Security's eBPF-based Linux runtime security and forensics tool — traces syscalls and events with a rules engine for detecting suspicious container/host behaviour live.

tracee --output json

Modular password-spraying tool with built-in modules for O365, Okta, OWA and more, plus optional proxying and Slack notifications for long-running sprays.

trevorspray -U users.txt -p Summer2026! --module o365enum

Aqua Security's all-in-one scanner — container images, filesystems, IaC and git repos for known CVEs, secrets and misconfigurations, fast enough to run in every CI pipeline.

trivy image myapp:latest

Google's automation framework for running forensic tools (Plaso, bulk_extractor, YARA and more) as a distributed pipeline against cloud-scale evidence, so a large IR engagement is not bottlenecked on one analyst's workstation.