AWS Pentest Tool

Markdown executive report

Automated AWS cloud security assessment framework for authorized audits, penetration tests, and red-team engagements.

---

Overview

AWS Pentest Tool audits AWS environments for identity risks, public exposure, secret leakage, weak trust relationships, logging gaps, and cloud service misconfigurations. It runs a multi-module assessment pipeline and produces a timestamped Markdown report with severity counts, evidence, proof-of-concept commands, and remediation guidance.

The CLI is designed for practical engagement work:

• Multi-region AWS enumeration through boto3
• Full audit and targeted module scan modes
• Rich terminal progress during long scans
• Executive-style Markdown reports in reports/
• Defensive and offensive validation helpers for authorized testing

Authorization required. Run this tool only against AWS accounts you own or have explicit written permission to test.

---

Table of Contents

• Quick Start
• Audit Modes
• Commands
• Module Coverage
• Report Output
• Screenshots
• Requirements
• Project Structure
• Security Notes
• License

---

Quick Start

git clone https://github.com/capture0x/aws-pentest.git
cd aws-pentest

python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

python3 aws_agent.py configure
python3 aws_agent.py audit --mode recon

Run a broader assessment:

python3 aws_agent.py audit --mode all --regions us-east-1,eu-west-1 --output reports

Run a targeted service scan:

python3 aws_agent.py scan-sts
python3 aws_agent.py scan-apigw --regions us-east-1,us-west-2
python3 aws_agent.py scan-dns --region us-east-1

---

Audit Modes

Mode	Scope	Recommended Use
recon	Core identity, storage, compute, serverless, network, logging, and governance checks	Fast initial assessment
loot	recon plus deeper network, RDS, KMS, secrets, ECR, EBS, and CloudTrail checks	Sensitive data and exposure review
all	Complete available scan path	Full engagement or final validation

Example:

python3 aws_agent.py audit --mode all --profile security-audit --regions us-east-1,eu-west-1

---

Commands

Core Commands

Command	Purpose
configure	Save AWS credentials to a local .env file with 0600 permissions
audit	Run the full orchestrated assessment and generate a Markdown report
exploit-iam	Show IAM privilege escalation findings and proof-of-concept commands
exploit-s3	Show S3 exposure and exploitation hints per bucket
backdoor-create	Create a persistent IAM administrator user; destructive and guarded by confirmation

Targeted Scans

Command	Module	Primary Checks
scan-sts	STS Cross-Account	Risky trust policies, weak ExternalId posture, OIDC providers, role chains
scan-apigw	API Gateway	Missing auth, weak resource policies, WAF gaps, JWT/CORS issues
scan-cognito	Cognito	Unauthenticated identity pools, weak MFA posture, app client exposure
scan-dynamodb	DynamoDB	Encryption, PITR, streams, resource policies
scan-sqs-sns	SQS / SNS	Public policies, HTTP subscriptions, missing server-side encryption
scan-cfn	CloudFormation	Secret outputs, stack role privilege risk, drift
scan-dns	Route53	Subdomain takeover candidates, DNSSEC, NS delegation risk
scan-codebuild	CodeBuild / CodePipeline	Plaintext secrets, privileged mode, artifact encryption
scan-waf	AWS WAF	Default action, missing managed rules, rate limiting, logging
scan-scp	AWS Organizations SCP	Guardrail coverage, missing critical denies, organization membership
scan-sfn	Step Functions / EventBridge	Public event buses, cross-account targets, state machine logging and secrets

Common Examples

python3 aws_agent.py audit --mode recon
python3 aws_agent.py audit --mode all --regions us-east-1,eu-west-1 --output /tmp/audit
python3 aws_agent.py audit --mode recon --auto-backdoor --verbose

python3 aws_agent.py exploit-iam --identity user/pentest-user
python3 aws_agent.py exploit-iam --auto-assume-role
python3 aws_agent.py exploit-s3 --bucket example-bucket

python3 aws_agent.py backdoor-create --dry-run
python3 aws_agent.py backdoor-create --user-name authorized-test-admin

---

Module Coverage