Cloud & Azure
Last updated
Last updated
MSOLSpray: A password spraying tool for Microsoft Online accounts (Azure/O365). The script logs if a user cred is valid, if MFA is enabled on the account, if a tenant doesn't exist, if a user doesn't exist, if the account is locked, or if the account is disabled.
PowerZure: PowerZure is a PowerShell project created to assess and exploit resources within Microsoft’s cloud platform, Azure. PowerZure was created out of the need for a framework that can both perform reconnaissance and exploitation of Azure, AzureAD, and the associated resources.
SharpCloud: Simple C# for checking for the existence of credential files related to AWS, Microsoft Azure, and Google Compute.
MicroBurst: A collection of scripts for assessing Microsoft Azure security.
ROADtools: The Azure AD exploration framework.
SkyArk: SkyArk helps to discover, assess and secure the most privileged entities in Azure and AWS.
BlobHunter: Find exposed data in Azure with this public blob scanner.
Prowler is an Open Source Security tool for AWS, Azure, GCP and Kubernetes to do security assessments, audits, incident response, compliance, continuous monitoring, hardening and forensics readiness. Includes CIS, NIST 800, NIST CSF, CISA, FedRAMP, PCI-DSS, GDPR, HIPAA, FFIEC, SOC2, GXP, Well-Architected Security, ENS and more
Add the following roles on the Azure:
ENTRA ID
Security Reader
Global Reader
Azure Resources
Domain Services Reader
Reader
After that, run the prowler with the following command line:
See the results with:
