v1.11.3

Commits

• dc0396f: updated logging path to have profile come before account-id to make it easier to find the right data (sethsec-bf) #45

v1.11.2

Commits

• 1fb9f4c: fixed services table to sort by service which is way more helpful (sethsec-bf) #44
• 03177e8: Fix paths on API Gateways & V2. Clean up path for S3 bucket endpoints as well (Wyatt Dahlenburg) #43
• adb9bcd: Handle stage in apigatewayv2 (Wyatt Dahlenburg) #43
• a9b95d9: merged from main (sethsec-bf) #44
• 2c5fec4: loading cache from files by default was a bad idea. changed default to not load cache from disk, and if the -c flag is used, then cache is loaded from disk (sethsec-bf) #44
• 6c8936c: fixed two segfault issues due to not checking if fields within a struct are nil (sethsec-bf)
• c11ebf9: fixed newly introduced eks bug in the caching function (region and cluster name were passed in the wrong order) (sethsec-bf)

v1.11.1

Commits

• 690b3c8: found and fixed some bugs in the new resource-trusts command (sethsec-bf)
• b8bf12f: found and fixed some bugs in the new resource-trusts command (sethsec-bf) #41
• 3c6c59e: Update README.md (Seth Art)

v1.11.0

AWS

• New Commands
  • resource-trusts - Looks at CodeBuild, ECR, EFS, Lambda, S3, SNS, SQS for any resource policies that might be interesting for a penetration tester
  • org - Checks if an account is in an org, and if it is, it tells you the org mgmt account. If run on the org management account, lists all accounts IDs and names
  • codebuild - Lists codebuild projects
  • databases - Enumerates databases including RDS, DynamoDB, RedShift, and DocsDB
• Updates
  • Output location - Changed the default output directory to ~./cloudfox/cloudfox-output (instead of current directory)
  • Output bug fix - Fixed bug that wrote buckets, sns, and sqs ouptut to the wrong directory when env vars were used instead of a profile
  • Permissions - Fixed multiple bugs that were skipping some policies - added support for just specifying the principal name and not the whole arn
  • Instances - Added ssm and ec2-instanceconnect commands to instance loot
  • Caching - Added function caching to reduce the number of AWS calls required (added a —ignore-cache option to disable this if needed). Only partially implemented so far.

Commits

• 59157b4: updated EFS to show file permissions and root directory info (sethsec-bf) #39
• f2f9377: updated inventory to include codebuild and started to break it out a bit into api call functions (sethsec-bf) #39
• 7f413fc: fixed bug in filesystems command (sethsec-bf) #39
• 1aca8cf: fixed bug in filesystems command related mount targets (sethsec-bf) #39
• bc91da0: fixed bug in permissions command where it was choking on statements with conditions (sethsec-bf) #39
• 56247f4: first draft of resource-trusts command (sethsec-bf) #39
• 186cd04: Finished codebuild test, added codeguild to resource-trusts command, updated ecr test to add new function to the client interface (sethsec-bf) #39
• 766fe55: added more to resource trusts module, started to move commands to shared initalizers (sethsec-bf) #39
• 7490d1a: fixed bug that wrote buckets, sns, sqs files in the wrong place when using environment variables (sethsec-bf) #39
• 0276ce2: initial draft of the orgs command (sethsec-bf) #39
• 5f7596b: more draft work on the orgs command (sethsec-bf) #39
• 8722782: merged from main (sethsec-bf) #39
• 8b2f13c: added ssm and ec2-instanceconnect commands to instances loot (sethsec-bf) #39
• 8e9bd42: finally added some logic so that if the user submits the name of the user/role/group instead of hte arn it will work anyway (sethsec-bf) #39
• ef1b37c: Added conditions col to the output to at least say if conditions exist on a permission (sethsec-bf) #39
• c059776: reworked the option to specify a principal so it works with groups also. i don't think it was working before (sethsec-bf) #39
• 2756cd0: changed default output dir to ~/.cloudfox/cloudfox-output (sethsec-bf) #39
• b29e4ea: changed output directory, added beginning phases of cached support - both within one single run, but also loading cached data from previous runs, added codebuild command, added orgs command, added databases command, switched everything to use carlos's output2 functions, changed the output flag from type (csv,table) to be like kubectl with wide/narrow (sethsec-bf) #39
• 497c794: migrated ecr to cached functions (sethsec-bf) #39
• ce6c3f7: migrated ecr and a few other functions in the endpoints and env-vars commands to use the cached functions (sethsec-bf) #39
• 9581425: updates to resource-trust command (sethsec-bf) #39
• d5956ce: tweak to database command cols (sethsec-bf) #39
• 2b294e5: updated wrapping for files written to disk, updated go modules (sethsec-bf) #39
• a0a64c5: bumped go version for releaser (sethsec-bf) #39
• 7b51d9d: updated tests (sethsec-bf) #39
• 5607558: bumped version to 1.11.0 (sethsec-bf) #39
• fc7a571: updated lambda header to name instead of arn (sethsec-bf) #40

v1.10.3

Commits

• 0397b5d: fixed bug in aws permissions - it was not handling policies applied to groups properly (sethsec-bf)

v1.10.2

Commits

• 51f0b65: bugfix 'SQS' and 'SNS' are inspected when 'all-checks' is executed. (motikan2010) #35
• 3652866: moved sns/sqs to another section in all-checks (sethsec-bf)
• 8ef71a6: fixed bug in env-vars where sagaemaker model exists but primarycontainer does not (sethsec-bf)

v1.10.1

Commits

• 07c4ddc: Update README.md (Seth Art)
• cecebb8: updated table file output to respect the wrap argument and the default which is to not wrap (sethsec-bf)
• 77c7edf: fixed an error handling bug on the az storage and whoami commands (carlosvendramini) #33
• 47c1184: attempt to fix a bug within az validatePublicBlobURLs (carlosvendramini) #33
• e6b5604: updated version tag to 1.10.1 (carlosvendramini) #33
• b3620ca: fixed output path in control messages for az inventory (carlosvendramini) #33
• 8550561: fixed bug in filesystems command related to regions (sethsec-bf)
• dc7c8c6: Merge branch 'main' into carlos-dev (Seth Art) #33

v1.10.0

AWS

New commands:

• network-ports - Enumerates AWS services that are potentially exposing a network service. The security groups and the network ACLs are parsed for each resource to determine what ports are potentially exposed. (thanks @wdahlenburg)
• sns - Enumerates all of the SNS topics and gives you the commands to subscribe to a topic or send messages to a topic. Only deals with topics, and not the SMS functionality. Also attempts to summarize topic resource policies if they exist. (thanks @DominicBreuker)
• sqs - Enumerates all of the SQS queues and gives you the commands to receive messages from a queue and send messages to a queue. Also attempts to summarize queue resource policies if they exist. (thanks @DominicBreuker)

Updates:

• Inventory command now gives you a loot file of arns of every identified resource
• Removed pmapper columns from other commands when pmapper data is not found
• Fixed bug in permissions command where notaction permissions were being listed as allowed

Azure

New Commands

• inventory - Enumerates all resources at the subscription level.

Updated Commands

• storage - The storage command now includes public blob URL enumeration

Commits

• ca66af7: Basic Network ACL and Security Group parsing. Support for EC2 and RDS network ports. (Wyatt Dahlenburg) #19
• a09b549: Merge branch 'main' into network-services (Wyatt Dahlenburg) #19
• 01267d5: add SNS and SQS commands with unit tests (Dominic Breuker) #21
• 0ceaa0a: use in-memory filesystem for unit tests (Dominic Breuker) #21
• 6e9aa37: Refactor + Merge of Lightsail, ELBv2, ECS, ElastiCache, & EFS detections (Wyatt Dahlenburg) #19
• 2b04fbb: Merge branch 'main' into network-services (Wyatt Dahlenburg) #19
• 5e87e96: made some superficial updates before merge with main (sethsec-bf) #19
• 1ffd763: updated network-ports sections of cli/aws to incorporate new structure (sethsec-bf) #19
• 1c64fa5: added new 1.9.0 smart service logic (sethsec-bf) #19
• a0c8e4b: Including ElastiCache in the cloudfox AWS policy (Wyatt Dahlenburg) #19
• f514b80: adding logic to ignore icmp (sethsec-bf) #19
• c265e5c: Merge branch 'network-services' of github.com:wdahlenburg/cloudfox into network-services (sethsec-bf) #19
• 91aa229: Restrict the processed security group rules to ALL, TCP, and UDP (Wyatt Dahlenburg) #19
• abeaa25: bumping version and adding prerelease notation before pushing to main (sethsec-bf) #19
• 7ec51b1: incorporated new changes from v1.9.0 into this PR (sethsec-bf) #21
• 767d2e6: added region check for each service to new commands (sethsec-bf) #21
• 3d054ea: the test run complained about a fmt error in networkports (sethsec-bf) #21
• 78cdf2e: updated readme to include network-ports from #19 (Seth Art)
• b64526f: initial draft of adding more context to sqs table (sethsec-bf) #21
• 4081025: wrote a prototype for az public blobs enumeration (carlosvendramini-bf) #31
• bb1f338: added wiki link to network-ports command (sethsec-bf) #29
• 8b5f79d: fixed pmapper path creation in linux to fix #28 (sethsec-bf) #29
• 7058d45: updated pmapper error state to point to wiki for next steps (sethsec-bf) #29
• 6599ad2: public blob enumeration almost done, just need to add URLs to loot file (carlosvendramini) #31
• ba57a02: az blob enumeration complete, also added loot file with urls, need to add unit tests (carlosvendramini) #31
• f1670f6: added new potential output design (carlosvendramini) #31
• 78ff665: finished new potential new output design, still need to discuss and test (carlosvendramini) #31
• 99b798b: finished the az inventory module PoC code (carlosvendramini) #31
• 2e8a454: output redesign ready for testing in prod (carlosvendramini) #31
• 466c8fc: small bug fix on output (carlosvendramini) #31
• dc7560c: added az inventory per subscription (carlosvendramini) #31
• cd66bbf: updated sns/sqs/buckets commands - likely going to remove this (sethsec-bf) #21
• f207a7c: updated sns/sqs/buckets commands - likely going to remove this (sethsec-bf) #21
• ac21f3a: finally got something worth pushing (sethsec-bf) #21
• 7c55958: added loot command output to sqs and sns (sethsec-bf) #21
• dbc9b1c: added a max flag for the tags command because some accounts have hundreds of thousands of tags. (sethsec-bf) #30
• 6aae684: added test for tags command (sethsec-bf) #30
• 152f7ea: added loot file to inventory which lists all identified arns (sethsec-bf) #30
• 5126020: removed pmapper column from output when pmapper data is not found (sethsec-bf) #30
• 2563ebb: removed pmapper column from output when pmapper data is not found (sethsec-bf) #30
• 3238ac8: switch awsservicemap behavior to pull latest servicemap from aws (sethsec-bf) #30
• b9f9a4f: updated some iam-simulator default actions (sethsec-bf) #30
• a8b73ef: Merge remote-tracking branch 'origin/seth-dev' into carlos-dev (carlosvendramini) #31
• 40933e2: fixed bug in permissions command where notaction permissions were being listed as allowed (sethsec-bf) #30
• 31027ba: updated all of the tests for sns/sqs/buckets to work with the new code (sethsec-bf) #21
• 303341c: updated the buckets test to use the big table string as the comparable like sns/sqs (sethsec-bf) #21
• 2b686e9: Merge remote-tracking branch 'origin' into seth-dev (sethsec-bf) #30
• 2e65bb3: added sqs and sns to readme (Seth Art)
• 96587ff: Update README.md (Seth Art)
• 41be219: added blobs test data (carlosvendramini) #31
• fc736f4: updated version tag to 1.10.0 (carlosvendramini)
• bb1313c: Bump golang.org/x/net from 0.2.0 to 0.7.0 (dependabot[bot]) #32
• 05481ae: az storage command now uses head method instead of get to check public blob URL (carlosvendramini)

v1.9.1

Commits

• dd688af: Updated README to split out Azure commands to their own table (Seth Art)
• 57aa072: Update README.md (Seth Art)
• b851515: Update README.md (Seth Art)
• acabb09: Update README.md (Seth Art)
• 45cd84b: Fix ssm:SendCommand typo (Jon Zeolla) #25

v1.9.0

AWS

New commands:

• ecs-tasks - List all ecs tasks. This returns a list of ecs tasks and associated cluster, task definition, container instance, launch type, and associated IAM principal. (thanks @DominicBreuker)
• elastic-network-interfaces - List all eni information. This returns a list of eni ID, type, external IP, private IP, VPCID, attached instance and a description. (thanks @DominicBreuker)
• eks - List all EKS clusters, see if they expose their endpoint publicly, and check the associated IAM roles attached to reach cluster or node group. Generates a loot file with the aws eks udpate-kubeconfig command needed to connect to each cluster.
• pmapper - Looks for pmapper data stored on the local filesystem, in the locations defined here. If pmapper data has been found (you already ran pmapper graph create), then this command will use this data to build a graph in cloudfox memory let you know who can privesc to admin.

Updates:

• Less errors: Cloudfox aws now avoids making queries to a region if a service is not supported there, and when regions are administratively disabled.
• Role Insights: instances, lambda, eks, ecs-tasks, and role-trusts commands now look for pmapper data, and if it exists, these commands will use the pmapper data and tell you 1) if the role attached to the workload is an admin, and 2) if the role can privesc to admin. If there is no pmapper data, cloudfox will use the iam-simulator command to at least tell you if the role is an admin.
• Role-trusts now shows federated role trusts (was missing earlier)

Azure

New Commands

• whoami - The whoami command displays information on the current tenant, subscriptions and resource groups available to your current Azure CLI session. This is useful to provide situation awareness on what tenant and subscription IDs to use with the other sub commands.
• storage - The storage command is still under development. Currently it only displays limited data about the storage accounts as shown in the examples below.

Updated Commands

• instances - The instances command enumerates the Compute instances' userful information at subscription or tenant level
• rbac - The rbac command maps the Azure RBAC role assignments at subscription or tenant level

Other updates

• Update inputs, outputs and UI to match the AWS command standards

Commits

• 3e3a9e8: Refactored some Azure authentication code (carlosvendramini-bf) #23
• 61da828: Added RG code to build a RG selector in Azure (carlosvendramini-bf) #23
• e919c3c: menu function for azure and test cases (carlosvendramini-bf) #23
• 5ec6101: refactored some azure client code (carlosvendramini-bf) #23
• 206542f: wrote an interactive menu for Azure (carlosvendramini-bf) #23
• e877139: refactoring azure instances command (carlosvendramini-bf) #23
• fe3a09a: finished refactoring az instances code, still need to add menu (carlosvendramini-bf) #23
• 0e12ca2: Merge remote-tracking branch 'origin/seth-dev' into carlos-dev (carlosvendramini-bf) #23
• d9b5c13: adjusted azure test cases (carlosvendramini-bf) #23
• b2033c0: Merge remote-tracking branch 'origin/seth-dev' into carlos-dev (carlosvendramini-bf) #23
• 7641a3e: adjusting menu for rg selection in azure (carlosvendramini-bf) #23
• 0e8febd: Merge remote-tracking branch 'origin/seth-dev' into carlos-dev (carlosvendramini-bf) #23
• dfae1ce: drafted a test for the AWS ecr command (carlosvendramini-bf) #23
• 36740bc: Merge remote-tracking branch 'origin/seth-dev' into carlos-dev (carlosvendramini-bf) #23
• 63e9338: changed order of code for readability (carlosvendramini-bf) #23
• 3b26a03: added carlos's test for ecr (sethsec-bf) #18
• 1caa02c: Merge branch 'main' of github.com:BishopFox/cloudfox into seth-dev (sethsec-bf) #18
• e1af1b8: sync lambda moduel to origin (sethsec-bf) #18
• 7cb4ba3: added exclusion for vscode launch files (carlosvendramini-bf) #23
• 73da61e: removed sample aws ecr unit tests (carlosvendramini-bf) #23
• d1d335f: azure interactive scope menu now returns subscription and rg (carlosvendramini-bf) #23
• 1926e2a: almost finished refactoring az instances, still some bugs (carlosvendramini-bf) #23
• 127f2c0: Merge remote-tracking branch 'origin/seth-dev' into carlos-dev (carlosvendramini-bf) #23
• a7cccdb: added better tests for azure instances command (carlosvendramini-bf) #23
• 5e7bfb3: created a constants package and moved azure and utils constants there (carlosvendramini-bf) #23
• 4a992d3: added identifier prefix to OutputSelector, it now prints [module][identifier] (carlosvendramini-bf) #23
• e262dae: added buckets test, fixed ecr test (sethsec-bf) #18
• 18a500f: fixed some bugs with az instances, still need to add sub and rg filters to az instances cli (cvendramini2) #23
• 59a7bd5: Merge remote-tracking branch 'origin/seth-dev' into carlos-dev (carlosvendramini-bf) #23
• f2cdf4d: add code for the ecs-tasks and elastic-network-interfaces commands (Dominic Breuker) #16
• 8fbfb38: added unit tests for aws ecs-tasks and elastic-network-interfaces (carlosvendramini-bf) #16
• d67a017: ecs-tasks and eni commands added to all-checks (carlosvendramini-bf) #16
• b1cff22: ecs-tasks and eni command ready to merge. Thank you @DominicBreuker! (carlosvendramini-bf) #16
• 8c00a82: updated AWS module count (carlosvendramini-bf)
• 5a71948: updated new modules to use the new cobra pattern (sethsec-bf) #18
• 6832898: adjusted azure instances test cases, moved test data to json files (carlosvendramini-bf) #23
• 037172c: added azure function to retrieve subscription for any given available resource group (carlosvendramini-bf) #23
• 0cce677: new azure instances modes: single subscription, resource group or interactive mode (carlosvendramini-bf) #23
• ee151be: Merge remote-tracking branch 'origin/seth-dev' into carlos-dev (carlosvendramini-bf) #23
• 72ce4f6: small outpuf fix for aws ecs-tasks and eni commands (carlosvendramini-bf) #23
• c450480: adjusted logging to no longer create a secondary logging file (carlosvendramini-bf) #23
• d460e63: added help menu use cases for azure commands (carlosvendramini-bf) #23
• 90261dd: added functions to set clients for azure rbac command (carlosvendramini-bf) #23
• 924c9db: added functions and test data for Azure RBAC command API calls (carlosvendramini-bf) #23
• 964dd5e: added tenants to azure scope functionality and test cases (carlosvendramini-bf) #23
• b92f61d: refactored some azure menu and scoping code to acommodate the new rbac command (carlosvendramini-bf) #23
• 274f16f: various bug fixes and code improvements (carlosvendramini-bf) #23
• 732ae09: rename constants package to globals (carlosvendramini-bf) #23
• f042e07: azure instances command adjustments (carlosvendramini-bf) #23
• ae3ac75: adjusted azure rbac command test template (carlosvendramini-bf) #23
• b8608a1: adjusted azure rba...