Endgame
Security and privacy
cloud security pentesting
SHOW HN2021
How HN took it
10 positive, 47 neutral or asking, 1 mixed, 7 critical, out of 65 comments about the project. Thread score +0.03.
Idea: 3 for, 5 againstExecution: 0 for, 1 againstDesign: 1 for, 0 againstDocs: 1 for, 0 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Good documentation and useful for audits
From 2 comments
Impressive tool, but the supporting documentation is what I appreciate most. I think the prevention guide could be improved by providing an example service control policy that…
nic-waller on HNIt is great that it is Public because as it will create some sense of urgency. Similar to how you expose a Bug on Aurora like following, every such finding will…
avi_vallarapu on HN
Useful for red team and auto-remediation testing
From 3 comments
for me, my environments are in different AWS accounts and can be torn down and stood back up rather quickly. so it wouldn't be a big deal to let this destroy a dev environment in…
stevehawk on HNExposing resources to a specific "evil principal" via Endgame would be reasonable in some attack simulations/red team engagements
ramimac on HNTo test autoremediation and alerting. At least in the environment I'm evolving these days it makes sense.
hnjst on HN
Objections
Dangerous if misconfigurations are exploited; risky to run non-dry-run
From 2 comments
I work with AWS a lot every day and lead a team responsible for building workloads on AWS for some customers with very high security requirements. This tool terrifies me. The…
ManWith2Plans on HNCan someone explain why you'd ever want to run this in the non-dryrun mode? I understand that if you have these problems you've already effectively granted those permissions…
tbrock on HN
Not real pentesting; only shows what given credentials can do
From 2 comments
> First, authenticate to AWS CLI using credentials to the victim's account. ... right. This is just a glorified "what can this IAM user do" tool. There is literally no actual…
urda on HNExcept it's not "Pentesting tool to backdoor" anything. It's simply modifying an access given you already have credentials to do that. You can do the same with aws cli (oh horror…
hrez on HN
Requests
Make dry-run the default
From 2 comments
dry run should be the default, and for you to actually do damage, you should explicitly run with a flag like `--commit` or `--deploy-evil-payload "yes I am certain of this"`
gchamonlive on HNYes please, thanks!!
Serow225 on HN
Questions
Why was the repository taken down?
From 2 comments
Does anyone have any ideas as to why this is being taken down? Hacking tools are released all the time. Why did this one make such a big ripple in the pond?
vorticalbox on HNAnybody have a mirror? It seems to have been taken down from GitHub. Also I guess it might have been a not so nice from an almost direct competitor of AWS - salesforce - to…
sdfhbdf on HN
Alternatives named
Pacu
From 1 comment
There are a lot of other tools in this space and people that specialize in AWS pentesting. Another popular tool is Pacu:…
poxrud on HN
CloudQuery
From 1 comment
Cool. Another tool in the space - https://github.com/cloudquery/cloudquery open-source framework to ask questions about your cloud infrastructure with SQL.
yevpats on HN
Cloud Custodian
From 1 comment
fwiw the opensource (and cncf incubator project) https://cloudcustodian.io can detect and remediate these modifications to embedded iam policies (across many resource types) in…
kapilvt on HN