[{"data":1,"prerenderedAt":483},["ShallowReactive",2],{"project-26154038":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":35,"aspects":36,"strip":44,"post_text":46,"what":47,"said":89,"maker_in_thread":187,"shape":195,"grid":199,"attempts":444,"same_week":445,"maker_shows":38,"maker_hidden":476,"reader_version":477,"card":478},"26154038","Endgame","An AWS Pentesting tool to backdoor or expose AWS resources","title","Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources","https:\u002F\u002Fgithub.com\u002Fsalesforce\u002Fendgame","github.com","kmcquade",1613485014,2021,368,93,87,2533,4,"legend","security_privacy","cloud security pentesting","cli",[24,25,26,27],"aws pentesting","iam permissions","cloud security audit","aws misconfiguration","curious",0.03,{"positive":31,"neutral":32,"mixed":33,"critical":34},10,47,1,7,65,{"idea":37,"execution":40,"design":42,"docs":43},{"positive":38,"critical":39},3,5,{"positive":41,"critical":33},0,{"positive":33,"critical":41},{"positive":33,"critical":41},[33,39,38,33,41,39,39,41,38,38,38,38,38,38,38,38,38,38,33,33,39,33,38,38,39,38,38,38,38,39,38,39,39,38,33,38,45,38,38,39],2,null,{"problem":48,"audience":62,"pricing":46,"motivation":70,"time_to_build":46,"stack":78,"openness":86,"stage":87,"team_size":88},{"value":49,"source":50,"evidence":51},"Finds and abuses excessive AWS permissions and misconfigured resource policies","maker",[52,55,59],{"id":53,"by":11,"text":54},"26154311","Author here :) Endgame exploits\u002Fabuses features. If it was a bug, I'd work with AWS to solve the problem, but with abusing features - that would result in years of unsatisfied…",{"id":56,"by":57,"text":58},"26155856","l33tman","Note that as far as I could tell, this is a tool to check which unexpected AWS modifications can be done from API keys that you do make public in the first place. It doesn't…",{"id":60,"by":11,"text":61},"26156159","> the tool can discover incorrect configurations that would allow someone who extracted the key to change permissions of the bucket. Nit: The tool can discover and abuse…",{"value":63,"source":64,"evidence":65},"Penetration testers and AWS security teams","inferred",[66,67],{"id":53,"by":11,"text":54},{"id":68,"by":11,"text":69},"26156144","Yes, you'd have to leverage compromised credentials. That could be obtained via SSRF, RCE on a privileged box, leakage of user access keys, or other means. In the context of a…",{"value":71,"source":50,"evidence":72},"Pressure AWS to fix feature-based permission issues that Access Analyzer misses",[73,74],{"id":53,"by":11,"text":54},{"id":75,"by":76,"text":77},"26154244","sodality2","My first thought was \"why is salesforce publishing essentially a hacking tool? why can't they bring it up privately, surely a large enough company will have some weight to their…",[79],{"value":80,"source":64,"evidence":81},"Python",[82],{"id":83,"by":84,"text":85},"26159570","cambalache","https:\u002F\u002Ffiles.pythonhosted.org\u002Fpackages\u002F0c\u002Ff0\u002F9eced7d6c57483c49db1a5bdbb4061e5f8346a3701bef9354e98b7f3f84e\u002Fendgame-0.2.0.tar.gz","open_source","launched","unknown",{"praise":90,"objections":118,"requests":141,"questions":153,"alternatives":165},[91,103],{"value":92,"source":93,"evidence":94},"Good documentation and useful for audits","commenter",[95,99],{"id":96,"by":97,"text":98},"26154505","nic-waller","Impressive tool, but the supporting documentation is what I appreciate most. I think the prevention guide could be improved by providing an example service control policy that…",{"id":100,"by":101,"text":102},"26154742","avi_vallarapu","It is great that it is Public because as it will create some sense of urgency. Similar to how you expose a Bug on Aurora like following, every such finding will…",{"value":104,"source":93,"evidence":105},"Useful for red team and auto-remediation testing",[106,110,114],{"id":107,"by":108,"text":109},"26156836","stevehawk","for me, my environments are in different AWS accounts and can be torn down and stood back up rather quickly. so it wouldn't be a big deal to let this destroy a dev environment in…",{"id":111,"by":112,"text":113},"26157672","ramimac","Exposing resources to a specific \"evil principal\" via Endgame would be reasonable in some attack simulations\u002Fred team engagements",{"id":115,"by":116,"text":117},"26157929","hnjst","To test autoremediation and alerting. At least in the environment I'm evolving these days it makes sense.",[119,130],{"value":120,"source":93,"evidence":121},"Dangerous if misconfigurations are exploited; risky to run non-dry-run",[122,126],{"id":123,"by":124,"text":125},"26156380","ManWith2Plans","I work with AWS a lot every day and lead a team responsible for building workloads on AWS for some customers with very high security requirements. This tool terrifies me. The…",{"id":127,"by":128,"text":129},"26155886","tbrock","Can someone explain why you'd ever want to run this in the non-dryrun mode? I understand that if you have these problems you've already effectively granted those permissions…",{"value":131,"source":93,"evidence":132},"Not real pentesting; only shows what given credentials can do",[133,137],{"id":134,"by":135,"text":136},"26159047","urda","> First, authenticate to AWS CLI using credentials to the victim's account. ... right. This is just a glorified \"what can this IAM user do\" tool. There is literally no actual…",{"id":138,"by":139,"text":140},"26172726","hrez","Except it's not \"Pentesting tool to backdoor\" anything. It's simply modifying an access given you already have credentials to do that. You can do the same with aws cli (oh horror…",[142],{"value":143,"source":93,"evidence":144},"Make dry-run the default",[145,149],{"id":146,"by":147,"text":148},"26154415","gchamonlive","dry run should be the default, and for you to actually do damage, you should explicitly run with a flag like `--commit` or `--deploy-evil-payload \"yes I am certain of this\"`",{"id":150,"by":151,"text":152},"26158095","Serow225","Yes please, thanks!!",[154],{"value":155,"source":93,"evidence":156},"Why was the repository taken down?",[157,161],{"id":158,"by":159,"text":160},"26163385","vorticalbox","Does anyone have any ideas as to why this is being taken down? Hacking tools are released all the time. Why did this one make such a big ripple in the pond?",{"id":162,"by":163,"text":164},"26158082","sdfhbdf","Anybody have a mirror? It seems to have been taken down from GitHub. Also I guess it might have been a not so nice from an almost direct competitor of AWS - salesforce - to…",[166,173,180],{"value":167,"source":93,"evidence":168},"Pacu",[169],{"id":170,"by":171,"text":172},"26158963","poxrud","There are a lot of other tools in this space and people that specialize in AWS pentesting. Another popular tool is Pacu:…",{"value":174,"source":93,"evidence":175},"CloudQuery",[176],{"id":177,"by":178,"text":179},"26156815","yevpats","Cool. Another tool in the space - https:\u002F\u002Fgithub.com\u002Fcloudquery\u002Fcloudquery open-source framework to ask questions about your cloud infrastructure with SQL.",{"value":181,"source":93,"evidence":182},"Cloud Custodian",[183],{"id":184,"by":185,"text":186},"26154677","kapilvt","fwiw the opensource (and cncf incubator project) https:\u002F\u002Fcloudcustodian.io can detect and remediate these modifications to embedded iam policies (across many resource types) in…",{"comments":188,"answered":45,"key":189},8,[190,191,194],{"id":53,"text":54},{"id":192,"text":193},"26154418","Thanks :)",{"id":68,"text":69},{"commenters":196,"max_depth":39,"maker_replies":188,"first_comment_mins":197,"lifespan_hours":198},64,26,39,[200,202,206,210,214,216,220,223,224,226,229,231,235,238,241,244,247,250,252,254,256,259,260,263,266,268,271,274,277,279,282,284,287,289,292,294,296,299,301,303,306,307,308,309,310,314,316,319,321,324,325,328,331,333,336,338,340,343,345,346,347,348,351,354,357,359,361,365,369,371,373,377,379,381,385,389,393,396,398,401,403,405,409,412,415,418,422,426,428,431,434,436,441],[123,41,33,201,124,41],"project\u002Fcritical\u002Fidea",[203,41,41,204,205,41],"26156606","commenter\u002Fpositive\u002Fidea","stjohnswarts",[207,41,39,208,209,41],"26156781","project\u002Fpositive\u002Fidea","xahrepap",[211,41,38,212,213,41],"26157260","project\u002Fneutral\u002Fidea","cddotdotslash",[170,41,38,215,171,41],"project\u002Fneutral\u002Fnone",[217,41,41,218,219,41],"26161355","other\u002Fneutral\u002Fnone","guywhocodes",[221,41,41,218,222,41],"26174032","Jimmc414",[75,33,33,201,76,41],[53,33,41,225,11,33],"maker\u002Fneutral\u002Fidea",[227,33,41,228,76,41],"26154378","commenter\u002Fneutral\u002Fnone",[192,33,41,230,11,33],"maker\u002Fneutral\u002Fnone",[232,33,39,233,234,41],"26154476","maker\u002Fpositive\u002Fnone","denismurphy",[236,33,41,218,237,41],"26154519","Operyl",[239,33,39,233,240,41],"26154875","mushufasa",[242,33,39,208,243,41],"26155827","kerng",[245,33,41,228,246,41],"26157659","jasperran",[248,33,41,218,249,41],"26162817","Mandatum",[251,33,41,218,237,41],"26164039",[253,33,38,230,205,41],"26156661",[255,33,41,228,246,41],"26157644",[257,33,38,215,258,41],"26158162","Blahah",[83,33,38,215,84,41],[261,33,41,228,262,41],"26160670","jeffmcjunkin",[264,33,38,215,265,41],"26161297","PeterCorless",[267,33,38,215,249,41],"26162798",[269,33,38,215,270,41],"26162957","dvaun",[272,45,41,218,273,41],"26158227","pachico",[275,45,38,215,276,41],"26158325","bdibs",[278,45,38,212,273,41],"26158422",[280,45,38,215,281,41],"26161144","EE84M3i",[283,45,38,215,171,41],"26158836",[285,45,38,215,286,41],"26159241","placebo",[288,45,38,215,249,41],"26162804",[290,45,38,215,291,41],"26159165","grapes",[293,45,38,215,76,41],"26160134",[295,45,38,215,265,41],"26161311",[297,45,38,215,298,41],"26161313","voicedYoda",[300,45,38,215,298,41],"26161315",[302,45,38,215,249,41],"26162803",[304,38,41,218,305,41],"26157207","booleanbetrayal",[56,18,38,212,57,41],[68,18,41,212,11,33],[60,18,41,212,11,33],[134,18,33,201,135,41],[311,39,33,312,313,41],"26154285","project\u002Fcritical\u002Fexecution","bwaine",[146,39,38,315,147,41],"project\u002Fneutral\u002Fdesign",[317,39,41,318,11,33],"26154437","maker\u002Fneutral\u002Fdesign",[150,39,39,320,151,41],"maker\u002Fpositive\u002Fdesign",[184,322,33,323,185,41],6,"project\u002Fcritical\u002Fnone",[162,34,38,215,163,41],[326,34,41,218,327,41],"26158226","andrewjmyers",[329,34,38,215,330,41],"26158237","metallikop",[332,34,38,215,159,41],"26163370",[334,34,38,215,335,41],"26158437","0xmohit",[337,34,38,215,298,41],"26161328",[96,188,39,339,97,41],"project\u002Fpositive\u002Fdocs",[341,188,41,342,11,33],"26154682","maker\u002Fneutral\u002Fdocs",[127,344,38,212,128,41],9,[107,344,38,212,108,41],[111,344,38,212,112,41],[115,344,38,215,116,41],[349,344,38,215,350,41],"26158118","artful-hacker",[352,31,38,215,353,41],"26158372","syntheticcorp",[355,31,41,228,356,41],"26158534","arkwin",[358,31,38,215,265,41],"26161317",[360,31,38,215,249,41],"26162805",[362,363,38,212,364,41],"26156822",11,"sk5t",[366,367,39,233,368,41],"26154730",12,"sandGorgon",[370,367,41,233,11,33],"26154783",[158,372,41,218,159,41],13,[374,375,38,230,376,41],"26157404",14,"simonebrunozzi",[378,375,41,228,246,41],"26157690",[100,380,39,208,101,41],15,[382,383,38,215,384,41],"26167749",16,"crankyoldnerd",[386,387,39,233,388,41],"26155246",17,"sub7",[390,387,38,391,392,41],"26161622","project\u002Fmixed\u002Fidea","Kocrachon",[394,387,41,228,395,41],"26161939","dodobirdlord",[397,387,41,228,392,41],"26171748",[399,400,38,215,249,41],"26162796",18,[177,402,38,215,178,41],19,[138,404,33,201,139,41],20,[406,407,38,215,408,41],"26158025",21,"robblbobbl",[410,411,38,215,356,41],"26158224",22,[413,411,38,230,414,41],"26158380","jaegerpicker",[416,417,38,215,273,41],"26158098",23,[419,420,33,201,421,41],"26160916",24,"mikesabbagh",[423,424,38,215,425,41],"26154506",25,"procrastinatus",[427,424,41,215,11,33],"26154595",[429,424,41,228,430,41],"26162741","Arnavion",[432,197,38,212,433,41],"26154513","jarym",[435,197,41,218,350,41],"26158232",[437,438,39,439,440,41],"26158142",27,"project\u002Fpositive\u002Fnone","idclip",[442,438,38,215,443,41],"26176328","dbmnt",[],[446,451,456,461,466,471],{"id":447,"name":448,"points":449,"category":450},"26134915","Khan-dl",473,"learning_science",{"id":452,"name":453,"points":454,"category":455},"26138446","ustaxes.org",465,"web_saas",{"id":457,"name":458,"points":459,"category":460},"26168285","Ray.so",384,"dev_tools",{"id":462,"name":463,"points":464,"category":465},"26131123","Jam",317,"consumer_social",{"id":467,"name":468,"points":469,"category":470},"26118756","natural-language-youtube-search",264,"ai",{"id":472,"name":473,"points":474,"category":475},"26128388","M1 Chart",205,"finance_crypto",false,"v2",{"id":479,"name":5,"line":6,"ai":476,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":29,"top":18,"kw":480,"maker":11,"domain":10,"tier":19,"attempts":41,"strip":481,"url":9,"mix":482,"praise":92,"objection":120,"sub":21},26154038,[24,25,26,27],"1531055033333333331151335333353553132335",[31,32,33,34],1794036603219]