Cloud-pentest

Resources to learn cloud environment and pentesting the same, contains AWS, Azure, Google Cloud

Serial No	Topic	Link
1	Basics	https://www.tutorialspoint.com/amazon_web_services/index.htm
2	Instance creation	https://github.com/awsdocs/amazon-ec2-user-guide/blob/master/doc_source/EC2_GetStarted.md https://github.com/awsdocs/amazon-ec2-user-guide/blob/master/doc_source/concepts.md
3	Storage	https://docs.aws.amazon.com/AmazonS3/latest/dev/s3-dg.pdf https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AmazonEBS.html https://docs.aws.amazon.com/storagegateway/latest/userguide/storagegateway-ug.pdf https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AmazonCloudFront_DevGuide.pdf
4	Database	https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/dynamodb-dg.pdf https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-ug.pdf https://docs.aws.amazon.com/redshift/latest/dg/redshift-dg.pdf
5	Networking	https://docs.aws.amazon.com/vpc/latest/userguide/vpc-ug.pdf https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/route53-dg.pdf https://docs.aws.amazon.com/directconnect/latest/UserGuide/dc-ug.pdf
6	Workspaces	https://docs.aws.amazon.com/workspaces/latest/adminguide/workspaces-ag.pdf
7	Lambda	https://docs.aws.amazon.com/lambda/latest/dg/lambda-dg.pdf
8	Full Guide	https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-ug.pdf
9	Vulnerability scanning	https://securityftw.github.io/
10	Penetration testing	https://github.com/dagrz/aws_pwn https://github.com/toniblyx/my-arsenal-of-aws-security-tools#offensive https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Cloud%20-%20AWS%20Pentest.md#aws---shadow-admin https://github.com/toniblyx/my-arsenal-of-aws-security-tools#continuous-security-auditing https://github.com/zricethezav/gitleaks https://github.com/RhinoSecurityLabs/pacu https://github.com/elitest/Redboto https://github.com/jordanpotti/AWSBucketDump https://github.com/RhinoSecurityLabs/Security-Research/tree/master/tools/aws-pentest-tools https://github.com/mxm0z/awesome-sec-s3 https://github.com/nagwww/s3-leaks https://owasp.org/www-chapter-pune/Pentesting_AWS_by_Anand_Varia.pdf https://gracefulsecurity.com/an-introduction-to-penetration-testing-aws-same-same-but-different/
11	Compliance	CIS security benchmark check for AMI instances CIS security benchmark check for IAM instances IAM user and access management best practices check Logging best practices check Networking best practices check Monitoring best practices check AWS Code build review for secret leaks (https://github.com/RhinoSecurityLabs/cloudgoat/blob/master/scenarios/codebuild_secrets/README.md) AWS Lambda environment best practices(https://github.com/OWASP/Serverless-Goat/blob/master/LESSONS.md) Lesson 3 Dynamo DB configuration best practices Third party packages vulnerability check VPC best practices EBS best practices EC2 metadata best practices ECR best practices EKS best practices ELB best practices
12	Source code review	https://github.com/RhinoSecurityLabs/cloudgoat/blob/master/scenarios/codebuild_secrets/README.md
13	Kubernetes	https://docs.aws.amazon.com/eks/latest/userguide/eks-ug.pdf
14	Container	https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-dg.pdf

---

Sheet 2: Google Cloud

Serial No	Topic	Link
1	Basics	https://intellipaat.com/blog/what-is-google-cloud/ https://github.com/gregsramblings/google-cloud-4-words https://www.linkedin.com/pulse/google-cloud-jumpstart-tutorials-community-david-das-neves/
2	Instance Creation	https://intellipaat.com/blog/what-is-google-cloud/ https://raw.githubusercontent.com/isb-cgc/readthedocs/master/docs/include/intro_to_Console.pdf https://cloud.google.com/compute/docs/concepts https://github.com/cs231n/gcloud
3	Storage	https://cloud.google.com/storage/docs/how-to https://cloud.google.com/storage/archival https://cloud.google.com/products/data-transfer https://cloud.google.com/storage/docs https://cloud.google.com/filestore/docs https://cloud.google.com/local-ssd https://cloud.google.com/persistent-disk
4	Networking	https://cloud.google.com/vpc/docs/vpc https://cloud.google.com/nat/docs https://cloud.google.com/load-balancing/docs https://cloud.google.com/dns/docs https://cloud.google.com/cdn/docs https://cloud.google.com/domains/docs
5	Database	https://cloud.google.com/sql/docs https://cloud.google.com/spanner/docs https://firebase.google.com/docs/database https://cloud.google.com/bigtable/docs https://cloud.google.com/firestore/docs
6	Bare metal	https://cloud.google.com/bare-metal/docs
7	Google Kubernetes Engine	https://cloud.google.com/kubernetes-engine/docs
8	Containers	https://cloud.google.com/compute/docs/containers
9	Vulnerabilty scanning	https://forsetisecurity.org/
10	Penetration testing	https://six2dez.gitbook.io/pentest-book/enumeration/cloud/gcp https://github.com/RhinoSecurityLabs/GCPBucketBrute https://github.com/dafthack/CloudPentestCheatsheets/blob/master/cheatsheets/GCP.md

---

Sheet 3: Azure

Serial No	Topic	Link
1	Basics	https://www.tutorialspoint.com/microsoft_azure/index.htm https://docs.microsoft.com/en-us/learn/paths/az-900-describe-cloud-concepts/
2	Instance Creation	https://docs.microsoft.com/en-us/learn/paths/azure-administrator-manage-compute-resources/ https://docs.microsoft.com/en-us/learn/modules/azure-compute-fundamentals/ https://docs.microsoft.com/en-us/learn/modules/create-windows-virtual-machine-in-azure/ https://docs.microsoft.com/en-us/learn/modules/intro-to-azure-virtual-machines/ https://docs.microsoft.com/en-us/learn/modules/manage-users-and-groups-in-aad/
3	Storage	https://docs.microsoft.com/en-us/learn/modules/azure-storage-fundamentals/
4	Networking	https://docs.microsoft.com/en-us/learn/modules/azure-networking-fundamentals/ https://docs.microsoft.com/en-us/learn/modules/manage-users-and-groups-in-aad/ https://docs.microsoft.com/learn/modules/connect-on-premises-network-with-vpn-gateway/
5	Database	https://docs.microsoft.com/en-us/learn/modules/azure-database-fundamentals/
6	Network security	https://docs.microsoft.com/en-us/learn/paths/az-900-describe-general-security-network-security-features/
7	System Secuirty	https://docs.microsoft.com/en-us/learn/modules/protect-against-security-threats-azure/
8	Active directory Managment	https://docs.microsoft.com/en-us/learn/modules/manage-users-and-groups-in-aad/ https://docs.microsoft.com/en-us/learn/modules/manage-users-and-groups-in-aad/
9	Docker containers	https://docs.microsoft.com/learn/modules/intro-to-docker-containers/ https://docs.microsoft.com/learn/paths/administer-containers-in-azure/
10	Kubernetes	https://docs.microsoft.com/learn/modules/connect-on-premises-network-with-vpn-gateway/
11	Pentesting	https://amp.kitploit.com/2020/04/roadtools-azure-ad-exploration-framework.html?amp=1&m=1 https://blog.xpnsec.com/azuread-connect-for-redteam/ https://blogvaronis2.wpengine.com/azure-skeleton-key/ https://www.synacktiv.com/en/publications/azure-ad-introduction-for-red-teamers.html https://dirkjanm.io/introducing-roadtools-and-roadrecon-azure-ad-exploration-framework/ https://github.com/appsecco/breaking-and-pwning-apps-and-servers-aws-azure-training/blob/master/README.md https://drive.google.com/file/d/1FPW5PbMzcHL-rRGSX4lewX3auQlAi-ix/view?usp=sharing https://drive.google.com/file/d/1O_LFQj0nHAXDvCNFWsiCEyLUpDqi-T5l/view?usp=sharing https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Cloud%20-%20Azure%20Pentest.md https://github.com/mattrotlevi/lava https://github.com/dafthack/CloudPentestCheatsheets/blob/master/cheatsheets/Azure.md https://github.com/NetSPI/MicroBurst https://attack.mitre.org/matrices/enterprise/cloud/azure/ https://book.hacktricks.xyz/cloud-security-review
12	Vulnerability Scanning	https://github.com/NextSecurity/azucar
13	Best practices	https://github.com/AZ-500-PREP/Audit-and-Remediate

---

Sheet 4: Common tools & Links

Name	Link
Terra Goat	https://github.com/bridgecrewio/terragoat
CS Suite	https://securityftw.github.io/
Collection	https://github.com/4ndersonLin/awesome-cloud-security
Talk by BlackHillsInfosec	https://www.blackhillsinfosec.com/wp-content/uploads/2020/05/Breaching-the-Cloud-Perimeter-Slides.pdf