Scan publicly accessible assets on your AWS cloud environment

Overview

poro

Poro art

Description

Scan for publicly accessible assets on your AWS environment Services covered by this tool:

  • AWS ELB
  • API Gateway
  • S3 Buckets
  • RDS Databases
  • EC2 instances
  • Redshift Databases

Prequisites

  • AWS account with Read Only Access to services listed above.
  • Python 3.X
  • Boto3 > 1.2X
  • Botocore > 1.2X
  • Requests > 2.2X

How to use

  • Clone this repository
  • Configure your envionment with active credentials -> aws configure
  • Run python poro.py Poro will print all exception raised when querying AWS APIs, the scanning result will be printed at the end of the output. Example of Poro output:
o ||    o ||
  _||    __||     
 ||     \\       Let the hunt begin.
_||  _)  \\  _) 


°° Searching for public buckets °°
Unexpected error whith bucket XXX: NoSuchBucketPolicy

°° Searching for exposed APIs °°

°° Searching for internet facing EC2 °°
Unexpected error when scanning ec2 in the region af-south-1: AWS was not able to validate the provided access credentials
Unexpected error when scanning ec2 in the region ap-east-1: AWS was not able to validate the provided access credentials

°° Searching for exposed ELBs °°

°° Searching for public RDS DB °°
Unexpected error when scanning RDS in the region af-south-1: The security token included in the request is invalid.

°° Searching for exposed redshift clusters °°
Unexpected error when scanning Redshift in the region af-south-1: The security token included in the request is invalid.
Unexpected error when scanning Redshift in the region ap-east-1: The security token included in the request is invalid.

Hunting results:
======================================================
================= Public Buckets =====================
1: Bucket name: XXX -> Public Policy

======================================================
================== Exposed APIs ======================
No public APIs

======================================================
================ Internet facing EC2 =================
No internet facing EC2s

======================================================
==================== Exposed ELB =====================
1: ELB ARN: arn:aws:elasticloadbalancing:us-west-2:XXX:XXX/XXX/XXX/XXX -> DNS: XXX.us-west-2.elb.amazonaws.com -> attached security groups:
------------- sg-XXX

======================================================
=================== Public RDS DB ====================
No public RDS DBs

======================================================
============= Public Redshift clusters ===============
No public Redshift clusters
You might also like...
Mass scan for .git repository and .env file exposure

Mass .Git repository and .Env file Scan by Scarmandef Scanner to find .env file and .git repository exposure on multiple hosts Because of the response

Let's you scan the entire internet in a couple of hours and identify all Minecraft servers on IPV4

Minecraft-Server-Scanner Let's you scan the entire internet in a couple of hours and identify all Minecraft servers on IPV4 Installation and running i

A Tool for subdomain scan with other tools

ReconTracer A Tool for subdomain scan with other tools ReconTracer Find subdomains by using another amazing sources!. Obs: In a close future recontrac

Sqli-Scanner is a python3 script written to scan websites for SQL injection vulnerabilities

Sqli-Scanner is a python3 script written to scan websites for SQL injection vulnerabilities Features 1 Scan one website 2 Scan multiple websites Insta

NexScanner is a tool which allows you to scan a website and find the admin login panel and sub-domains
NexScanner is a tool which allows you to scan a website and find the admin login panel and sub-domains

NexScanner NexScanner is a tool which helps you scan a website for sub-domains and also to find login pages in the website like the admin login panel

This is tools hacking for scan vuln in port web, happy using
This is tools hacking for scan vuln in port web, happy using

Xnuvers007 PortInjection this is tools hacking for scan vuln in port web, happy using view/show python 3.9 solo coder (tangerang) 19 y/o installation

Um script simples de Port Scan + DNS by Hostname
Um script simples de Port Scan + DNS by Hostname

🖥 PortScan-DNS Esta é uma ferramenta simples de Port Scan + DNS by Hostname... 💻 | DNS Resolver / by Hostname: HOST IP EXTERNO IP INTERNO 💻 | Port

Log4j vuln fuzz/scan with python
Log4j vuln fuzz/scan with python

Log4jFuzz log4j vuln fuzz/scan USE // it's use localhost udp server to check target vuln. python3 log4jFuzz.py [option] optional arguments: -u URL,

A script to search, scrape and scan for Apache Log4j CVE-2021-44228 affected files using Google dorks

Log4j dork scanner This is an auto script to search, scrape and scan for Apache Log4j CVE-2021-44228 affected files using Google dorks. Installation:

Comments
  • Error when querying ELBs

    Error when querying ELBs

    °° Searching for exposed ELBs °° Traceback (most recent call last): File "poro.py", line 24, in elbs=getELB() File "/home/cloudshell-user/poro/modules/elb.py", line 23, in getELB publicLoadbalancers.append([elb['LoadBalancerArn'],[elb['DNSName'],elb['SecurityGroups']]]) KeyError: 'SecurityGroups'

    Script terminates when error is encountered.

    opened by sfrizzle 2
  • Add more-itertools to requirements.txt

    Add more-itertools to requirements.txt

    @9rnt thank you for the awesome package!

    I was getting this error when trying to run poro:

    Traceback (most recent call last):
      File "poro.py", line 3, in <module>
        from more_itertools import bucket
    ModuleNotFoundError: No module named 'more_itertools'
    
    opened by delenamalan 0
  • Wrong export format when file is JSON

    Wrong export format when file is JSON

    Hello @9rnt ,

    I've been trying this cool tool today. Tried the --export option and I have some questions.

    It says it will export it to a file, so I ran poro like this:

    python poro.py --export RESULT_PORO.json
    

    But the output file looks like the following. You will see, it's not a well formed JSON:

    {
      'Public buckets': [
        {
          'Name': 'my-example-of-public-bucket',
          'Rational': 'Public Policy'
        }
      ],
      'Public API': [],
      'Public EC2': [],
      'Public ELB': [],
      'Public RDS': [],
      'Public Redshift clusters': []
    }
    

    Is this expected?

    If I wanted a JSON, it should have double quotes instead:

    {
      "Public buckets": [
        {
          "Name": "my-example-of-public-bucket",
          "Rational": "Public Policy"
        }
      ],
      "Public API": [],
      "Public EC2": [],
      "Public ELB": [],
      "Public RDS": [],
      "Public Redshift clusters": []
    }
    

    Thank you

    opened by w0rmr1d3r 0
  • Verbose level or debug level

    Verbose level or debug level

    Hello @9rnt and maintainers 👋

    Thank you for this cool repo/tool 🚀

    I was trying it today and wanted to make sure I got the instructions right. It seems the verbose, when set as -v needs several v to have it in DEBUG mode. Such as -vvvv. Will it be possible to have that in the instructions and in the -h option?

    At the same time, when running poro with --verbose, like this python poro.py --verbose. It seems the log level hasn´t changed to DEBUG, since I see the same output as if I was running it without that option.

    Thank you again

    opened by w0rmr1d3r 0
Owner
9rnt
Cloud and emerging technologies
9rnt
A set of blender assets created for the $yb NFT project.

fyb-blender A set of blender assets created for the $yb NFT project. Install just as you would any other Blender Add-on (via Edit->Preferences->Add-on

Pedro Arroyo 1 May 6, 2022
A passive-recon tool that parses through found assets and interacts with the Hackerone API

Hackerone Passive Recon Tool A passive-recon tool that parses through found assets and interacts with the Hackerone API. Setup Simply run setup.sh to

elbee 4 Jan 13, 2022
Providing DevOps and security teams script to identify cloud workloads that may be vulnerable to the Log4j vulnerability(CVE-2021-44228) in their AWS account.

We are providing DevOps and security teams script to identify cloud workloads that may be vulnerable to the Log4j vulnerability(CVE-2021-44228) in their AWS account. The script enables security teams to identify external-facing AWS assets by running the exploit on them, and thus be able to map them and quickly patch them

Mitiga 13 Jan 4, 2022
Scan your logs for CVE-2021-44228 related activity and report the attackers

jndiRep - CVE-2021-44228 Basically a bad grep on even worse drugs. search for malicious strings decode payloads print results to stdout or file report

js-on 2 Nov 24, 2022
Scan all java processes on your host to check weather it's affected by log4j2 remote code execution

Log4j2 Vulnerability Local Scanner (CVE-2021-45046) Log4j 漏洞本地检测脚本,扫描主机上所有java进程,检测是否引入了有漏洞的log4j-core jar包,是否可能遭到远程代码执行攻击(CVE-2021-45046)。上传扫描报告到指定的服

null 86 Dec 9, 2022
These are Simple python scripts to test/scan your network

Disclaimer This tool is for Educational purpose only. We do not promote or encourage any illegal activities. Summary These are Simple python scripts t

Varun Jagtap 5 Oct 8, 2022
NIVOS is a hacking tool that allows you to scan deeply , crack wifi, see people on your network

NIVOS is a hacking tool that allows you to scan deeply , crack wifi, see people on your network. It applies to all linux operating systems. And it is improving every day, new packages are added. Thank You For Using NIVOS :> [NIVOS Created By NIVO Team]

Error 263 Jan 1, 2023
A Burp extension adding a passive scan check to flag parameters whose name or value may indicate a possible insertion point for SSRF or LFI.

BurpParamFlagger A Burp extension adding a passive scan check to flag parameters whose name or value may indicate a possible insertion point for SSRF

Allyson O'Malley 118 Nov 7, 2022
A fast tool to scan prototype pollution vulnerability

proto A fast tool to scan prototype pollution vulnerability Syntax python3 proto.py -l alive.txt Requirements Selenium Google Chrome Webdriver Note :

Muhammed Mahdi 4 Aug 31, 2021
Scan Site - Tools For Scanning Any Site and Get Site Information

Site Scanner Tools For Scanning Any Site and Get Site Information Example Require - pip install colorama - pip install requests How To Use Download Th

NumeX 5 Mar 19, 2022