playbook-cloud
Cloud security playbook — AWS/GCP/Azure misconfiguration and attack patterns (IAM, storage, metadata, privesc). Load when the target is a cloud environment or you obtain cloud creds/metadata. Triggers - AWS/GCP/Azure, IAM role/policy, S3/blob bucket, 169.254.169.254 metadata, access key, assume-role, cloud console.
git clone --depth 1 https://github.com/s0ld13rr/pentestcode /tmp/playbook-cloud && cp -r /tmp/playbook-cloud/skills/playbooks/cloud ~/.claude/skills/playbook-cloudSKILL.md
# Cloud Security Assessment Playbook ## AWS ### Reconnaissance ```bash # Enumerate S3 buckets aws s3 ls s3://<company>-<env> --no-sign-request aws s3 ls s3://<bucket> --no-sign-request --recursive # Check for public snapshots aws ec2 describe-snapshots --owner-ids <account_id> --region <region> # IMDS (from compromised EC2) curl http://169.254.169.254/latest/meta-data/ curl http://169.254.169.254/latest/meta-data/iam/security-credentials/ curl http://169.254.169.254/latest/user-data ``` ### Credential Abuse ```bash # Configure stolen credentials export AWS_ACCESS_KEY_ID=<key> export AWS_SECRET_ACCESS_KEY=<secret> # Enumerate permissions aws sts get-caller-identity aws iam list-attached-user-policies --user-name <user> aws iam get-policy-version --policy-arn <arn> --version-id v1 # Enumerate resources aws ec2 describe-instances --region <region> aws s3api list-buckets aws lambda list-functions --region <region> aws rds describe-db-instances --region <region> aws secretsmanager list-secrets --region <region> ``` ### Privilege Escalation - `iam:CreatePolicyVersion` → attach admin policy - `iam:AttachUserPolicy` → attach AdministratorAccess - `lambda:CreateFunction` + `iam:PassRole` → execute as privileged role - `sts:AssumeRole` → pivot to other roles - Tools: `pacu`, `pmapper` ## GCP ### Reconnaissance ```bash # Metadata server (from compromised instance) curl -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/ curl -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token # Enumerate with credentials gcloud projects list gcloud compute instances list gcloud storage ls gcloud iam service-accounts list gcloud secrets list ``` ### Key Checks - Public Cloud Storage buckets - Default service account with broad permissions - Overprivileged IAM bindings - Exposed GKE clusters - Cloud Functions with secrets in env vars ## Azure ### Reconnaissance ```bash # Enumerate tenant info curl https://login.microsoftonline.com/<domain>/.well-known/openid-configuration # IMDS (from compromised VM) curl -H "Metadata: true" "http://169.254.169.254/metadata/instance?api-version=2021-02-01" curl -H "Metadata: true" "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/" # With token az account list az vm list az storage account list az keyvault list az ad user list ``` ### Key Checks - Public blob storage containers - Exposed App Services / Function Apps - Overprivileged Managed Identities - Azure AD misconfigurations (guest access, app registrations) - Network Security Groups allowing broad ingress - Key Vault access policies ## Cross-Cloud Checks - Hardcoded credentials in repos/CI - Overprivileged service accounts - Public storage (S3/GCS/Blob) - Metadata service access (SSRF → cloud creds) - Logging gaps (CloudTrail/StackDriver/Azure Monitor) - MFA not enforced on admin accounts
Work with Effect v4 / effect-smol TypeScript code in this repo
Active enumeration phase — port scanning, service detection, banner grabbing. Use when the current phase is ENUMERATION.
Exploitation phase — exploit confirmed vulns, credential attacks, gain access. Use when the current phase is EXPLOITATION.
Post-exploitation phase — privilege escalation, lateral movement, credential dumping, data discovery. Use when the current phase is POST_EXPLOIT.
Passive reconnaissance phase — OSINT, DNS, WHOIS, subdomain discovery. Use when starting a new engagement or when the current phase is RECON.
Reporting phase — generate structured pentest report from findings. Use when the current phase is REPORTING.
Vulnerability assessment phase — scanning, CVE lookup, misconfig detection. Use when the current phase is VULN_ASSESS.
Active Directory pentest playbook — Kerberos, LDAP, GPO, ADCS, delegation, lateral movement, DA paths. Load at the START of an AD engagement or when a Windows domain / DC is found. Triggers - domain controller, Kerberos 88, LDAP 389/636, domain SMB, BloodHound, kerberoast, AS-REP, NTLM, ESC1-8.