Raqib v0.12.0

Raqib v0.12.0

Deepens exfiltration coverage on Azure, GCP, and Kubernetes. With this release, all four clouds cover the six tactics in depth, from reconnaissance and privilege escalation through persistence, lateral movement, and exfiltration. Both the bash scanner and the Python engine gain the checks and stay in lockstep.

Azure exfiltration

• Minting a SAS token that shares a storage account out, a shareable URL to its blobs.
• Exporting a disk or snapshot as a downloadable image, a full copy of a machine.
• Reading Cosmos DB keys, which open every database in the account.

GCP exfiltration

• Creating storage HMAC keys, interoperable credentials that read Cloud Storage from anywhere, outside the project audit.
• Exporting a Cloud SQL database to a bucket.

Kubernetes exfiltration

• Reading pod logs, which leak secrets, tokens, and data. The bash and Python engines are now aligned here: both weigh secrets, config maps, and logs, and leave a subject that can only read secrets to the lateral movement check, so there is no duplicate finding.

A milestone

Across four releases, coverage of the non-AWS clouds has grown from the primary paths to full depth on every tactic. raqib.sh defends prints the whole cloud by tactic map.

Quality

• New sample principals for each path and four new tests. All four least privilege samples still produce zero findings, and the two engines produce the same findings on every cloud. 137 tests pass.

Independent tool, not affiliated with or endorsed by any cloud provider. Read only: it lists and describes authorization configuration and never changes anything.