Tools

we45/dvfaas-damn-vulnerable-functions-as-a-service

Intentionally Vulnerable Serverless Functions to understand the specifics of Serverless Security Vulnerabilities

firecracker-microvm/firecracker

Secure and fast microVMs for serverless computing.

datadog/stratus-red-team

:cloud: :zap: Granular, Actionable Adversary Emulation for the Cloud

iknowjason/awesome-cloudsec-labs

Awesome free cloud native security learning labs. Includes CTF, self-hosted workshops, guided vulnerability labs, and research labs.

owasp/dvsa

a Damn Vulnerable Serverless Application

semgrep/semgrep

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

0x4d31/honeylambda

honeyλ - a simple, serverless application designed to create and monitor fake HTTP endpoints (i.e. URL honeytokens) automatically, on top of AWS…

rhinosecuritylabs/pacu

The AWS exploitation framework, designed for testing the security of Amazon Web Services environments.

nccgroup/scoutsuite

Multi-cloud security auditing tool that leverages cloud provider APIs to gather configuration data, assess security posture, and generate HTML…

pumasecurity/serverless-prey

Serverless Functions for establishing Reverse Shells to Lambda, Azure Functions, and Google Cloud Functions

fyoorer/shadowclone

Serverless task distribution framework that parallelizes CLI tools across thousands of cloud functions for rapid reconnaissance and data processing.

bishopfox/cloudfox

Automating situational awareness for cloud penetration tests.

m-mizutani/alertresponder

Automatic security alert response framework by AWS Serverless Application Model