Find cloud assets that no one wants exposed 🔎 ☁️
Find exposed AWS cloud assets that you did not know you had. A comprehensive asset inventory is step one to any capable security program. We made smogcloud to enable security engineers, penetration testers, and AWS administrators to monitor the collective changes that create dynamic and ephemeral internet-facing assets on a more frequent basis. May be useful to identify:
Install smogcloud using the following command
go get -u github.com/BishopFox/smogcloud
Set up aws environment variable for the account you wish to query. We suggest utilizing a read-only Security Auditor role. The following commands can be used to set environment variables:
export AWS_ACCOUNT_ID='' # Describe account export AWS_ACCESS_KEY_ID='' # Access key for aws account export AWS_SECRET_ACCESS_KEY='' # Secret key for aws account
Run the application
go run main.go
Supported services for extracting internet exposures:
* API Gateway * CloudFront * EC2 * Elastic Kubernetes Service * Elastic Beanstalk * Elastic Search * Elastic Load Balancing * IoT * Lightsail * MediaStore * Relational Database Service * Redshift * Route53 * S3
From studying Open API documentation on RESTful AWS endpoints we determined these are the patterns of exposure URIs that you may find in AWS accounts. It is important to understand how to interact with these native services to test them for vulnerabilities and other misconfigurations. Security engineers may want to monitor Cloudtrail logs or build DNS monitoring for requests to these services.
We do our best to maintain our tools, but can't always keep them as up to date as we'd like. So, we always appreciate code contributions, feature requests, and bug reports.
Smogcloud is licensed under GPLv3, some subcomponents have seperate licenses.