AI-Powered Application Penetration Testing—Scale Security Without Compromise Learn More

bishopfox-logo-grey
Get Started

Offensive Tools

CloudFox: Find exploitable attack paths in cloud infrastructure.

CloudFox is a command line tool created to help penetration testers and other offensive security professionals find exploitable attack paths in cloud infrastructure. It currently supports AWS & GCP.

Get on GitHub

About CloudFox

A collection of enumeration commands that illuminate attack paths for cloud penetration testing.

The main inspiration for CloudFox was to create something like PowerView for cloud infrastructure. A collection of enumeration commands that illuminate attack paths even for those relatively new to cloud penetration testing. To do this, we codified our many sed/awk/grep/jq incantations into a tool that is portable, modular, and quick. Our primary audience is penetration testers, but we think CloudFox will be useful for all cloud security practitioners. CloudFox currently supports Amazon Web Services (AWS) & Google Cloud Platform (GCP).

With CloudFox, security practitioners can:

  • Gain situational awareness in unfamiliar cloud environments
  • Automate the laborious parts of cloud penetration testing
  • Identify more exploitable attack paths in less time
Cloudfoxable Logo2

Can You Hack the Cloud?

Introducing CloudFoxable: A Gamified Cloud Hacking Sandbox

CloudFoxable is an intentionally vulnerable AWS environment created specifically to teach the art of AWS cloud penetration testing, while showcasing CloudFox’s capabilities that help you find latent attack paths more effectively. 

Drawing inspiration from CloudGoat, flaws.cloud, and Metasploitable, CloudFoxable provides a wide array of flags and attack paths in a capture-the-flag (CTF) format.

Access CloudFoxable GitHub Repo

Creators & Contributors

Bishop Fox Security Researcher Seth Art.

Seth Art

Bishop Fox Alumnus

Bishop Fox senior security consultant Carlos Vendramini headshot

Carlos Vendramini

Bishop Fox Alumnus

Black ink looking drawing of a man in a VR set holding a bouquet of flowers in a Banksy art style with digital grid in the background.

Joseph Barcia

Senior Security Consultant

More Research

Check out these related resources on CloudFox.

WORKSHOP

CloudFox: Cloud Enumeration for Penetration Testing

Resource card background 006
In this session, Mitchell Sperling, Senior Security Consultant at Bishop Fox, will demonstrate how he uses CloudFox during cloud penetration tests to quickly enumerate large cloud environments and identify interesting attack paths.
Watch Session
BLOG

Introducing CloudFox GCP: Attack Path Identification for Google Cloud

Resource card background 004
CloudFox GCP extends CloudFox’s offensive security methodology to Google Cloud Platform, enabling practitioners to enumerate cloud resources, map identity permissions, and identify service account risks across the organization hierarchy.
Read the Blog
WALKTHROOUGH

CloudFoxable: A Practical Demo of AWS Cloud Security Misconfiguration Attacks

Resource card background 002
Watch the CloudFoxable demo to see a gamified cloud hacking sandbox where users can find latent attack paths in an intentionally vulnerable AWS environment.
Watch the Demo

This site uses cookies to provide you with a great user experience. By continuing to use our website, you consent to the use of cookies. To find out more about the cookies we use, please see our Privacy Policy.