Virtual Event: Threat Detection and Incident Response Summit - Watch Sessions
Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cloud Security

Bishop Fox Releases Open Source Cloud Hacking Tool ‘CloudFox’

Cybersecurity firm Bishop Fox has announced the release of CloudFox, an open source tool designed to help find exploitable attack paths in cloud infrastructure.

The command line tool has been created for penetration testers and other offensive security professionals.

Cybersecurity firm Bishop Fox has announced the release of CloudFox, an open source tool designed to help find exploitable attack paths in cloud infrastructure.

The command line tool has been created for penetration testers and other offensive security professionals.

CloudFox provides a collection of enumeration commands that make it easy to use even for people who are relatively new to cloud pentesting.

As of now it only works with AWS, but Bishop Fox also plans on adding support for Microsoft Azure, Google Cloud Platform, and Kubernetes.

“CloudFox is designed to be executed by a principal with limited read-only permissions, but its purpose is to help you find attack paths that can be exploited in simulated compromise scenarios (aka, objective based penetration testing),” Bishop Fox explained.

The tool can identify the regions used by the AWS account and the number of resources in common services, secrets in EC2 user data, the principal’s permissions, exposed endpoints or IPs, and file systems that can be mounted from a compromised resource from within the VPC.

“There are a lot of tools that help you analyze cloud environments, but many of them are more focused on security baseline compliance rather than attack paths. We hope you find that CloudFox can automate the boring stuff and help you identify and exploit latent attack paths more quickly and comprehensively,” said Seth Art, principal security consultant at Bishop Fox.

Advertisement. Scroll to continue reading.

The CloudFox source code is available on GitHub. Additional technical details and a demo video can be found in a blog post published by Bishop Fox.

Related: New Open Source Tool Shows Code Injected Into Websites by In-App Browsers

Related: Aqua Security Ships Open Source Tool for Auditing Software Supply Chain

Related: Academics Devise Open Source Tool For Hunting Node.js Security Flaws

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.

Register

Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.

Register

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Vulnerabilities

The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.

Vulnerabilities

Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.

Vulnerabilities

Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...