:fox_face: CloudFox :fox_face:

CloudFox helps you gain situational awareness in unfamiliar cloud environments. It’s an open source command line tool created to help penetration testers and other offensive security professionals find exploitable attack paths in cloud infrastructure.

CloudFox helps you answer the following common questions (and many more):

• What regions is this AWS account using and roughly how many resources are in the account?
• What secrets are lurking in EC2 userdata or service specific environment variables?
• What workloads have administrative permissions attached?
• What actions/permissions does this [principal] have?
• What role trusts are overly permissive or allow cross-account assumption?
• What endpoints/hostnames/IPs can I attack from an external starting point (public internet)?
• What endpoints/hostnames/IPs can I attack from an internal starting point (assumed breach within the VPC)?
• What filesystems can I potentially mount from a compromised resource inside the VPC?

Demos, Examples, Walkthroughs

• Blog - Introducing: CloudFox
• Video - CloudFox Intro Demo's
• Video - Tool Talk: CloudFox AWS sub-command walkthroughs

Quick Start

CloudFox is modular (you can run one command at a time), but there is an aws all-checks command that will run the other aws commands for you with sane defaults:

cloudfox aws --profile [profile-name] all-checks

White Box Enumeration

CloudFox was designed to be executed by a principal with limited read-only permissions, but it's purpose is to help you find attack paths that can be exploited in simulated compromise scenarios (aka, objective based penetration testing).

Black Box Enumeration

CloudFox can be with "found" credentials, similar to how you would use weirdAAL or enumerate-iam. Checks that fail, do so silently, so any data returned means your "found" creds have the access needed to retrieve it.

For the full documentation please refer to our wiki.

Supported Cloud Providers

Install

Option 1: Download the latest binary release for your platform.

Option 2: Install Go, clone the CloudFox repository and compile from source

# git clone https://github.com/BishopFox/cloudfox.git
...omitted for brevity...
# cd ./cloudfox
# go build .
# ./cloudfox

Prerequisites

AWS

• AWS CLI installed
• Supports AWS profiles, AWS environment variables, or metadata retrieval (on an ec2 instance)
  • To run commands on multiple profiles at once, you can specify the path to a file with a list of profile names seperated by a new line using the -l flag or pass all stored profiles with the -a flag.
• A principal with one recommended policies attached (described below)
• Recommended attached policies: SecurityAudit + CloudFox custom policy

Additional policy notes (as of 09/2022):

Azure

• Viewer or similar permissions applied.

Supported Commands

Authors

• Carlos Vendramini
• Seth Art (@sethsec)

Contributing

Wiki - How to Contribute

TODO

• AWS - Add support for GovCloud and China regions

FAQ

How does CloudFox compare with ScoutSuite, Prowler, Steampipe's AWS Compliance Module, AWS Security Hub, etc.

CloudFox doesn't create any alerts or findings, and doesn't check your environment for compliance to a baseline or benchmark. Instead, it simply enables you to be more efficient during your manual penetration testing activities. If gives you the information you'll likely need to validate whether an attack path is possible or not.

Why do I see errors in some CloudFox commands?

• Services that don't exist in all regions - CloudFox tries a few ways to figure out what services are supported in each region. However some services don't support the methods CloudFox uses, so CloudFox defaults to just asking every region about the service. Regions that don't suppor the service will return errors.
• You don't have permission - Another reason you might see errors if you don't have permissions to make calls that CloudFox is making. Either because the policy doesn't allow it (e.g., SecurityAudit doesn't allow all of the permissions CloudFox needs. Or, it might be an SCP that is blocking you.

You can always look in the ~/.cloudfox/cloudfox-error.log file to get more information on errors.

Prior work and other related projects

• SmogCloud - Inspiration for the endpoints command
• SummitRoute's AWS Exposable Resources - Inspiration for the endpoints command
• Steampipe - We used steampipe to prototype many cloudfox commands. While CloudFox is laser focused on helping cloud penetration testers, steampipe is an easy way to query any and all of your cloud resources.
• Principal Mapper - Inspiration for, and a strongly recommended partner to the iam-simulator command
• Cloudsplaining - Inspiration for the permissions command
• ScoutSuite - Excellent cloud security benchmark tool. Provided inspiration for the --userdata functionality in the instances command, the permissions command, and many others
• Prowler - Another excellent cloud security benchmark tool.
• Pacu - Excellent cloud penetration testing tool. PACU has quite a few enumeration commands similar to CloudFox, and lots of other commands that automate exploitation tasks (something that CloudFox avoids by design)
• CloudMapper - Inspiration for the inventory command and just generally CloudFox as a whole