Do analogous tools exist for GCP and Azure?
[deleted]
Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources
61–70 of 101 posts
Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources
#62404? someone got an urgent call from AWS and politely requested to remove it since both companies are supposed to be partners?
It looks that way. Looks like some of it was archived though at https://web.archive.org/web/20210216153239/https://github.co... . Also still live at PyPI: https://pypi.org/project/endgame/
Of course this was going to happen. Who knows, probably this way the author achieved what be wanted and those policy exploits will be revisited, at last.
Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources
#63Anybody have a mirror? It seems to have been taken down from GitHub. Also I guess it might have been a not so nice from an almost direct competitor of AWS - salesforce - to publish something like that. Salesforce owns heroku.
Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources
#64The main repository seems to have been taken down but it is still available at https://github.com/kmcquade/endgame and on Pypi
Thanks!
Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources
#65404? someone got an urgent call from AWS and politely requested to remove it since both companies are supposed to be partners?
Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources
#66I work with AWS a lot every day and lead a team responsible for building workloads on AWS for some customers with very high security requirements. This tool terrifies me. The sheer amount of potential for misconfiguration of resources that this tool can exploit with no effort whatsoever is absolutely insane. I feel like every AWS environment I've ever seen is suddenly at risk of some angry employee compromising every…
There are a lot of other tools in this space and people that specialize in AWS pentesting. Another popular tool is Pacu: https://rhinosecuritylabs.com/aws/pacu-open-source-aws-explo...
Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources
#67Note that as far as I could tell, this is a tool to check which unexpected AWS modifications can be done from API keys that you do make public in the first place. It doesn't "hack" an account per se. So for example if you've created some IAM API keys and embedded in an app for example, and you (incorrectly) believe the permissions only grant the app to fetch some static media files from an S3 bucket, the tool can dis…
> First, authenticate to AWS CLI using credentials to the victim's account.
... right. This is just a glorified "what can this IAM user do" tool. There is literally no actual pentesting done. Not much different than having the key to your neighbor's front door and seeing how many things inside their house are unlocked for you.
Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources
#68404? someone got an urgent call from AWS and politely requested to remove it since both companies are supposed to be partners?
Here's the source: https://files.pythonhosted.org/packages/0c/f0/9eced7d6c57483...
Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources
#69Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources
#70Earlier quoted context omitted.
Author here :) Endgame exploits/abuses features. If it was a bug, I'd work with AWS to solve the problem, but with abusing features - that would result in years of unsatisfied feature requests. This should push the issue along. >...and it's not even a hacking tool! It can be used to backdoor resources to rogue accounts, so I'd say it's a hacking tool and can/should be used on penetration tests. I'd certainly use it o…
Can you share the code somewhere else? It's been taken down from github