Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
nimbostratus-target — This repository holds a target infrastructure you can use for running the nimbostratus tools. | Kitploit
Tools/GitHubGitHub/andresriancho/nimbostratus-target
Cloud Infrastructure SecurityVulnerability AnalysisPenetration TestingCloud SecurityMisconfigurationLearning & EducationLabs & Practice
GitHubandresriancho/nimbostratus-target

nimbostratus-target

This repository holds a target infrastructure you can use for running the nimbostratus tools.

View Repository
2418211 years agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Website
Share

Nimbostratus target

This repository holds a target infrastructure you can use for testing nimbostratus.

This code deploys an Amazon AWS infrastructure which has various vulnerabilities and weak configuration settings which can be exploited using nimbostratus.

If you're not sure what this is all about, you better avoid using any of the code that lives here.

Installation

root@kitploit:~
sudo apt-get install python-mysqldb
git clone [email protected]:andresriancho/nimbostratus-target.git
cd nimbostratus-target
pip install -r requirements.txt

Usage

Starting the environment

Make sure you have configured your "root" AWS credentials in ~/.boto before you run the fabric script.

root@kitploit:~
fab deploy

The console messages will show you the progress to understand what's deployed and where. At the end you should end up with the following AWS components:

  • Front-end EC2 instance with:
    • HTTP server and vulnerable Web application
    • Celery configured to use SQS as broker
    • Deployed using user-data script
    • With an instance profile which allows acces to SQS
  • Backend worker:
    • Consumes SQS messages sent by front-end instance
    • Uses pickle as serialization method
    • No instance profile configured, hard-coded AWS credentials
    • AWS credentials can access RDS:* and IAM:*
    • Stores information in RDS database using low-privileged user
  • RDS database
  • IAM user for backend worker

A successfull run should look like this.

Killing the environment

Once you finish playing with this Amazon cloud, just delete it with:

root@kitploit:~
fab teardown

Disclaimer

  • This code wasn't developed for re-usability.
  • Running this code will create Amazon AWS charges!
  • The teardown command might fail, charges might be applied by Amazon even after running it. You're responsible of checking the state of your services after running this tool.
Download Tool