Cookie Consent by Free Privacy Policy Generator ๐Ÿ“Œ TerraformGoat - "Vulnerable By Design" Multi Cloud Deployment Tool

๐Ÿ  Team IT Security News

TSecurity.de ist eine Online-Plattform, die sich auf die Bereitstellung von Informationen,alle 15 Minuten neuste Nachrichten, Bildungsressourcen und Dienstleistungen rund um das Thema IT-Sicherheit spezialisiert hat.
Ob es sich um aktuelle Nachrichten, Fachartikel, Blogbeitrรคge, Webinare, Tutorials, oder Tipps & Tricks handelt, TSecurity.de bietet seinen Nutzern einen umfassenden รœberblick รผber die wichtigsten Aspekte der IT-Sicherheit in einer sich stรคndig verรคndernden digitalen Welt.

16.12.2023 - TIP: Wer den Cookie Consent Banner akzeptiert, kann z.B. von Englisch nach Deutsch รผbersetzen, erst Englisch auswรคhlen dann wieder Deutsch!

Google Android Playstore Download Button fรผr Team IT Security



๐Ÿ“š TerraformGoat - "Vulnerable By Design" Multi Cloud Deployment Tool


๐Ÿ’ก Newskategorie: IT Security Nachrichten
๐Ÿ”— Quelle: kitploit.com


TerraformGoat is selefra research lab's "Vulnerable by Design" multi cloud deployment tool.

Currently supported cloud vendors include Alibaba Cloud, Tencent Cloud, Huawei Cloud, Amazon Web Services, Google Cloud Platform, Microsoft Azure.


Scenarios

ID Cloud Service Company Types Of Cloud Services Vulnerable Environment
1 Alibaba Cloud Networking VPC Security Group Open All Ports
2 Alibaba Cloud Networking VPC Security Group Open Common Ports
3 Alibaba Cloud Object Storage Bucket HTTP Enable
4 Alibaba Cloud Object Storage Object ACL Writable
5 Alibaba Cloud Object Storage Object ACL Readable
6 Alibaba Cloud Object Storage Special Bucket Policy
7 Alibaba Cloud Object Storage Bucket Public Access
8 Alibaba Cloud Object Storage Object Public Access
9 Alibaba Cloud Object Storage Bucket Logging Disable
10 Alibaba Cloud Object Storage Bucket Policy Readable
11 Alibaba Cloud Object Storage Bucket Object Traversal
12 Alibaba Cloud Object Storage Unrestricted File Upload
13 Alibaba Cloud Object Storage Server Side Encryption No KMS Set
14 Alibaba Cloud Object Storage Server Side Encryption Not Using BYOK
15 Alibaba Cloud Elastic Computing Service ECS SSRF
16 Alibaba Cloud Elastic Computing Service ECS Unattached Disks Are Unencrypted
17 Alibaba Cloud Elastic Computing Service ECS Virtual Machine Disks Are Unencrypted
18 Tencent Cloud Networking VPC Security Group Open All Ports
19 Tencent Cloud Networking VPC Security Group Open Common Ports
20 Tencent Cloud Object Storage Bucket ACL Writable
21 Tencent Cloud Object Storage Bucket ACL Readable
22 Tencent Cloud Object Storage Bucket Public Access
23 Tencent Cloud Object Storage Object Public Access
24 Tencent Cloud Object Storage Unrestricted File Upload
25 Tencent Cloud Object Storage Bucket Object Traversal
26 Tencent Cloud Object Storage Bucket Logging Disable
27 Tencent Cloud Object Storage Server Side Encryption Disable
28 Tencent Cloud Elastic Computing Service CVM SSRF
29 Tencent Cloud Elastic Computing Service CBS Storage Are Not Used
30 Tencent Cloud Elastic Computing Service CVM Virtual Machine Disks Are Unencrypted
31 Huawei Cloud Networking ECS Unsafe Security Group
32 Huawei Cloud Object Storage Object ACL Writable
33 Huawei Cloud Object Storage Special Bucket Policy
34 Huawei Cloud Object Storage Unrestricted File Upload
35 Huawei Cloud Object Storage Bucket Object Traversal
36 Huawei Cloud Object Storage Wrong Policy Causes Arbitrary File Uploads
37 Huawei Cloud Elastic Computing Service ECS SSRF
38 Huawei Cloud Relational Database Service RDS Mysql Baseline Checking Environment
39 Amazon Web Services Networking VPC Security Group Open All Ports
40 Amazon Web Services Networking VPC Security Group Open Common Ports
41 Amazon Web Services Object Storage Object ACL Writable
42 Amazon Web Services Object Storage Bucket ACL Writable
43 Amazon Web Services Object Storage Bucket ACL Readable
44 Amazon Web Services Object Storage MFA Delete Is Disable
45 Amazon Web Services Object Storage Special Bucket Policy
46 Amazon Web Services Object Storage Bucket Object Traversal
47 Amazon Web Services Object Storage Unrestricted File Upload
48 Amazon Web Services Object Storage Bucket Logging Disable
49 Amazon Web Services Object Storage Bucket Allow HTTP Access
50 Amazon Web Services Object Storage Bucket Default Encryption Disable
51 Amazon Web Services Elastic Computing Service EC2 SSRF
52 Amazon Web Services Elastic Computing Service Console Takeover
53 Amazon Web Services Elastic Computing Service EBS Volumes Are Not Used
54 Amazon Web Services Elastic Computing Service EBS Volumes Encryption Is Disabled
55 Amazon Web Services Elastic Computing Service Snapshots Of EBS Volumes Are Unencrypted
56 Amazon Web Services Identity and Access Management IAM Privilege Escalation
57 Google Cloud Platform Object Storage Object ACL Writable
58 Google Cloud Platform Object Storage Bucket ACL Writable
59 Google Cloud Platform Object Storage Bucket Object Traversal
60 Google Cloud Platform Object Storage Unrestricted File Upload
61 Google Cloud Platform Elastic Computing Service VM Command Execution
62 Microsoft Azure Object Storage Blob Public Access
63 Microsoft Azure Object Storage Container Blob Traversal
64 Microsoft Azure Elastic Computing Service VM Command Execution


Install

TerraformGoat is deployed using Docker images and therefore requires Docker Engine environment support, Docker Engine installation can be found in https://docs.docker.com/engine/install/

Depending on the cloud service provider you are using, choose the corresponding installation command.

Alibaba Cloud

docker pull registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_aliyun:0.0.4
docker run -itd --name terraformgoat_aliyun_0.0.4 registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_aliyun:0.0.4
docker exec -it terraformgoat_aliyun_0.0.4 /bin/bash

Tencent Cloud

docker pull registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_tencentcloud:0.0.4
docker run -itd --name terraformgoat_tencentcloud_0.0.4 registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_tencentcloud:0.0.4
docker exec -it terraformgoat_tencentcloud_0.0.4 /bin/bash

Huawei Cloud

docker pull registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_huaweicloud:0.0.4
docker run -itd --name terraformgoat_huaweicloud_0.0.4 registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_huaweicloud:0.0.4
docker exec -it terraformgoat_huaweicloud_0.0.4 /bin/bash

Amazon Web Services

docker pull registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_aws:0.0.4
docker run -itd --name terraformgoat_aws_0.0.4 registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_aws:0.0.4
docker exec -it terraformgoat_aws_0.0.4 /bin/bash

Google Cloud Platform

docker pull registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_gcp:0.0.4
docker run -itd --name terraformgoat_gcp_0.0.4 registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_gcp:0.0.4
docker exec -it terraformgoat_gcp_0.0.4 /bin/bash

Microsoft Azure

docker pull registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_azure:0.0.4
docker run -itd --name terraformgoat_azure_0.0.4 registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_azure:0.0.4
docker exec -it terraformgoat_azure_0.0.4 /bin/bash


Demo

After entering the container, cd to the corresponding scenario directory and you can start deploying the scenario.

Here is a demonstration of the Alibaba Cloud Bucket Object Traversal scenario build.

docker pull registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_aliyun:0.0.4
docker run -itd --name terraformgoat_aliyun_0.0.4 registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat_aliyun:0.0.4
docker exec -it terraformgoat_aliyun_0.0.4 /bin/bash


ย 

cd /TerraformGoat/aliyun/oss/bucket_object_traversal/
aliyun configure
terraform init
terraform apply



The program prompts Enter a value:, type yes and enter, use curl to access the bucket, you can see the object traversed.



To avoid the cloud service from continuing to incur charges, remember to destroy the scenario in time after using it.

terraform destroy

๏š€
Uninstall

If you are in a container, first execute the exit command to exit the container, and then execute the following command under the host.

docker stop $(docker ps -a -q -f "name=terraformgoat*")
docker rm $(docker ps -a -q -f "name=terraformgoat*")
docker rmi $(docker images -a -q -f "reference=registry.cn-beijing.aliyuncs.com/huoxian_pub/terraformgoat*")

Notice

  1. The README of each vulnerable environment is executed within the TerraformGoat container environment, so the TerraformGoat container environment needs to be deployed first.
  2. Due to the horizontal risk of intranet horizontal on the cloud in some scenarios, it is strongly recommended that users use their own test accounts to configure the scenarios, avoid using the cloud account of the production environment, and install TerraformGoat using Dockerfile to isolate the user's local cloud vendor token and the test account token.
  3. TerraformGoat is used for educational purposes only, It is not allowed to use it for illegal and criminal purposes, any consequences arising from TerraformGoat are the responsibility of the person using it, and not the selefra organization.


Contributing

Contributions are welcomed and greatly appreciated. Further reading โ€” CONTRIBUTING.md for details on contribution workflow.

License

TerraformGoat is under the Apache 2.0 license. See the LICENSE file for details.



...



๐Ÿ“Œ Und Microsoft so: Cloud, Cloud, Cloud, Cloud, Cloud, Cloud, Cloud


๐Ÿ“ˆ 28.24 Punkte

๐Ÿ“Œ Multi-Cloud-Strategie: Multi-Cloud: Vorteile nutzen - Herausforderungen meistern


๐Ÿ“ˆ 25.47 Punkte

๐Ÿ“Œ Security bei Multi-Cloud: Wie kรถnnen Sie die Sicherheit in einer Multi-Cloud-Umgebung verbessern?


๐Ÿ“ˆ 25.47 Punkte

๐Ÿ“Œ Security bei Multi-Cloud: Wie kรถnnen Sie die Sicherheit in einer Multi-Cloud-Umgebung verbessern?


๐Ÿ“ˆ 25.47 Punkte

๐Ÿ“Œ Datenorganisation in einer Multi-Cloud-Umgebung: Haben Sie eine Datenstrategie fรผr Ihre Multi-Cloud-Umgebung?


๐Ÿ“ˆ 25.47 Punkte

๐Ÿ“Œ Multi-Cloud-Kosten: So behalten Sie Ihre Multi-Cloud-Kosten im Griff


๐Ÿ“ˆ 25.47 Punkte

๐Ÿ“Œ Multi Cloud, Container und Open Source: Multi Cloud wird zum Vorreiter einer offenen IT-Welt


๐Ÿ“ˆ 25.47 Punkte

๐Ÿ“Œ Security bei Multi-Cloud: Wie kรถnnen Sie die Sicherheit in einer Multi-Cloud-Umgebung verbessern?


๐Ÿ“ˆ 25.47 Punkte

๐Ÿ“Œ Datenorganisation in einer Multi-Cloud-Umgebung: Haben Sie eine Datenstrategie fรผr Ihre Multi-Cloud-Umgebung?


๐Ÿ“ˆ 25.47 Punkte

๐Ÿ“Œ Multi-Cloud-Kosten: So behalten Sie Ihre Multi-Cloud-Kosten im Griff


๐Ÿ“ˆ 25.47 Punkte

๐Ÿ“Œ Multi-Cloud-Strategie: Darum setzen CIOs auf die Multi-Cloud


๐Ÿ“ˆ 25.47 Punkte

๐Ÿ“Œ Multi-Cloud-Optimierung: Insider-Tipps, wie man Multi Cloud in den Griff bekommt


๐Ÿ“ˆ 25.47 Punkte

๐Ÿ“Œ Multi-Cloud-Security fรผr die C-Suite: Wissen Sie, wie eine gute Multi-Cloud-Security aussieht?


๐Ÿ“ˆ 25.47 Punkte

๐Ÿ“Œ Ransomware vs. Multi-Cloud: How to Protect Multi-Cloud Environments From the Next Attack


๐Ÿ“ˆ 25.47 Punkte

๐Ÿ“Œ Deployment-Fehler: 3 Wege in die Multi-Cloud-Hรถlle


๐Ÿ“ˆ 24.98 Punkte

๐Ÿ“Œ Vizru ZEOS: Managing stability, performance and deployment of apps across multi-cloud environments


๐Ÿ“ˆ 24.98 Punkte

๐Ÿ“Œ Virginia 'Broadband Deployment Act' Would Kill Municipal Broadband Deployment


๐Ÿ“ˆ 24.49 Punkte

๐Ÿ“Œ Create Deployment Using โ€œkubectl create deploymentโ€


๐Ÿ“ˆ 24.49 Punkte

๐Ÿ“Œ Virginia 'Broadband Deployment Act' Would Kill Municipal Broadband Deployment


๐Ÿ“ˆ 24.49 Punkte

๐Ÿ“Œ Google Cloud Earns Defense Contract Win For Anthos Multi-Cloud Management Tool


๐Ÿ“ˆ 22.31 Punkte

๐Ÿ“Œ Multi-cloud doesnโ€™t have to mean multi problems for data protection


๐Ÿ“ˆ 21.44 Punkte

๐Ÿ“Œ Von Multi-Cloud zu Multi-X


๐Ÿ“ˆ 21.44 Punkte

๐Ÿ“Œ Der Schlรผssel zum Management von Compliance-Risiken in einer Multi-Cloud- und Multi-Cluster-Welt


๐Ÿ“ˆ 21.44 Punkte

๐Ÿ“Œ Deployment challenges in Multi-Access Edge Computing (MEC)


๐Ÿ“ˆ 20.95 Punkte

๐Ÿ“Œ CockroachDB simplifies multi-region deployment


๐Ÿ“ˆ 20.95 Punkte

๐Ÿ“Œ New Linux malware evades detection using multi-stage deployment


๐Ÿ“ˆ 20.95 Punkte

๐Ÿ“Œ How Veriff decreased deployment time by 80% using Amazon SageMaker multi-model endpoints


๐Ÿ“ˆ 20.95 Punkte

๐Ÿ“Œ Kafka Multi-Cluster Deployment on Kubernetes: Simplified!


๐Ÿ“ˆ 20.95 Punkte

๐Ÿ“Œ Cloud Security Alliance Study Identifies New And Unique Security Challenges In Native Cloud, Hybrid And Multi-cloud Environments


๐Ÿ“ˆ 20.8 Punkte

๐Ÿ“Œ Tufin SecureCloud now secures cloud-native, multi-cloud, and hybrid-cloud workloads and applications


๐Ÿ“ˆ 20.8 Punkte

๐Ÿ“Œ Beta version of multi-tool Collaboration for Reverse Engineering tool (CollaRE)


๐Ÿ“ˆ 19.78 Punkte

๐Ÿ“Œ Maintaining order in a hybrid cloud, multi-tool world


๐Ÿ“ˆ 18.28 Punkte

๐Ÿ“Œ IBM offers Cybersecurity Tool for Multi and Hybrid cloud environments


๐Ÿ“ˆ 18.28 Punkte











matomo