Offensive Terraform
Popular repositories
-
offensive-terraform.github.io
offensive-terraform.github.io PublicOffensive Terraform Website
-
terraform-aws-ec2-instance-reverse-shell
terraform-aws-ec2-instance-reverse-shell PublicOffensive Terraform module which creates EC2 instance and reverse shell from an EC2 instance to attacker machine.
-
terraform-aws-ec2-kali-linux
terraform-aws-ec2-kali-linux PublicOffensive Terraform module which creates Kali Linux from the AWS marketplace and installs cloud security tools (Pacu, Cloudsplaining, ScoutSuite).
-
terraform-aws-ebs-snapshot-publicly-exposed
terraform-aws-ebs-snapshot-publicly-exposed PublicOffensive Terraform module which copies publicly exposed EBS snapshot to us-east-1 region in attacker's AWS account and creates EBS volume from the copied EBS snapshot. After that, the module attac…
-
terraform-aws-cross-account-persistence
terraform-aws-cross-account-persistence PublicOffensive Terraform module which creates an IAM role with trust relationship with attacker's AWS account and attaches managed IAM Policy to an IAM role.
-
terraform-aws-lambda-function-credential-exfiltration
terraform-aws-lambda-function-credential-exfiltration PublicOffensive Terraform module which creates Lambda function with existing IAM role. The module invokes it automatically to exfiltrate AWS temporary credential from environment variables and send it ba…
Repositories
- terraform-aws-lambda-function-credential-exfiltration Public
Offensive Terraform module which creates Lambda function with existing IAM role. The module invokes it automatically to exfiltrate AWS temporary credential from environment variables and send it back with response.
-
- terraform-aws-ec2-kali-linux Public
Offensive Terraform module which creates Kali Linux from the AWS marketplace and installs cloud security tools (Pacu, Cloudsplaining, ScoutSuite).
-
- terraform-aws-ec2-instance-reverse-shell Public
Offensive Terraform module which creates EC2 instance and reverse shell from an EC2 instance to attacker machine.
- terraform-aws-s3-subdomain-takeover Public
Offensive Terraform module which takes over a subdomain which has a CNAME record pointing to non-existing S3 bucket in target's Route53. The module creates a S3 bucket with a name as subdomain in the specific AWS region that CNAME record is pointing to. Also, it uploads a simple web page with "404 Page Not Found" text.
- terraform-aws-rds-snapshot-publicly-exposed Public
Offensive Terraform module which creates RDS database from a publicly exposed RDS snapshot in attacker's AWS account. After that, attacker can connect to RDS database and inspect it.
- terraform-aws-ebs-snapshot-publicly-exposed Public
Offensive Terraform module which copies publicly exposed EBS snapshot to us-east-1 region in attacker's AWS account and creates EBS volume from the copied EBS snapshot. After that, the module attaches and mounts the EBS volume to an EC2 instance. Finally, attacker can ssh into an EC2 instance and inspect a mounted volume "/usr/src/hack".
- terraform-aws-iam-create-user-persistence Public
Offensive Terraform module which creates IAM user, access key then attaches managed IAM Policy to an IAM user.
- terraform-aws-ec2-instance-credential-exfiltration Public
Offensive Terraform module which creates EC2 instance and exfiltrate credential from Instance metadata to external URL.
