> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/aws-pentesting/resources.md).

# Resources & Tools

## 🛠️ Essential Tools

### Offensive

| Tool                                                            | Install                   | Purpose                                |
| --------------------------------------------------------------- | ------------------------- | -------------------------------------- |
| [Pacu](https://github.com/RhinoSecurityLabs/pacu)               | `git clone + pip install` | Full AWS exploitation framework        |
| [enumerate-iam](https://github.com/andresriancho/enumerate-iam) | `git clone + pip install` | Brute-force permissions                |
| [s3scanner](https://github.com/sa7mon/S3Scanner)                | `pip install s3scanner`   | Find public S3 buckets                 |
| [WeirdAAL](https://github.com/carnal0wnage/weirdAAL)            | `git clone`               | AWS attack modules library             |
| [CloudGoat](https://github.com/RhinoSecurityLabs/cloudgoat)     | `git clone + pip install` | Vulnerable lab environment             |
| [IAM Vulnerable](https://github.com/BishopFox/iam-vulnerable)   | Terraform                 | Provision intentionally vulnerable IAM |

### Defensive / Auditing

| Tool                                                           | Install                      | Purpose                          |
| -------------------------------------------------------------- | ---------------------------- | -------------------------------- |
| [ScoutSuite](https://github.com/nccgroup/ScoutSuite)           | `pip install scoutsuite`     | Multi-cloud security audit       |
| [Prowler](https://github.com/prowler-cloud/prowler)            | `pip install prowler`        | CIS/NIST benchmark checks        |
| [CloudMapper](https://github.com/duo-labs/cloudmapper)         | `git clone + pip install`    | Visualize AWS network            |
| [cloudsplaining](https://github.com/salesforce/cloudsplaining) | `pip install cloudsplaining` | IAM policy risk analysis         |
| [AWSPX](https://github.com/WithSecureLabs/awspx)               | Docker                       | Graph-based attack path analysis |

***

## 📚 Learning Resources

### Free Challenges

* [flaws.cloud](http://flaws.cloud) — S3, metadata, IAM challenges (beginner)
* [flaws2.cloud](http://flaws2.cloud) — Attacker & defender perspective
* [CloudGoat Scenarios](https://github.com/RhinoSecurityLabs/cloudgoat/tree/master/scenarios) — 10+ scenarios
* [TryHackMe AWS Rooms](https://tryhackme.com/paths) — Guided AWS labs

### Reading

* [HackTricks AWS Pentesting](https://cloud.hacktricks.xyz/pentesting-cloud/aws-pentesting)
* [Rhino Security Labs Blog](https://rhinosecuritylabs.com/blog/)
* [AWS Security Blog](https://aws.amazon.com/blogs/security/)
* [MITRE ATT\&CK Cloud](https://attack.mitre.org/matrices/enterprise/cloud/)
* [CloudSecWiki](https://cloudsec.wiki)

### Courses

* [A Cloud Guru — AWS Security Specialty](https://acloudguru.com)
* [PentesterAcademy AWS Red Team](https://www.pentesteracademy.com)
* [TCM Security Practical Cloud Pentesting](https://tcm-sec.com)

***

## 📋 Certification Path

| Cert                              | Focus                       | Level        |
| --------------------------------- | --------------------------- | ------------ |
| AWS Solutions Architect Associate | AWS fundamentals            | Beginner     |
| AWS Security Specialty            | Security controls & defense | Intermediate |
| CPTS (HTB)                        | General pentesting + cloud  | Intermediate |
| OSCP                              | Core pentesting skills      | Intermediate |
| AWS Advanced Networking           | Network attack surface      | Advanced     |

***

## 🔑 Common S3 Bucket Name Wordlists

```
# Pattern: <company>-<env>-<resource>
company-dev
company-prod
company-staging
company-backup
company-backups
company-logs
company-data
company-assets
company-media
company-uploads
company-exports
company-reports
company-archive
company-internal
company-private
company-public
company-static
company-cdn
company-terraform
company-tfstate
```

***

## ⚙️ Setup Scripts

```bash
# Full setup in one shot (Ubuntu/Debian)
sudo apt update && sudo apt install -y python3-pip git curl unzip

pip3 install awscli boto3 scoutsuite prowler s3scanner

# Pacu
git clone https://github.com/RhinoSecurityLabs/pacu ~/tools/pacu
cd ~/tools/pacu && pip3 install -r requirements.txt

# enumerate-iam
git clone https://github.com/andresriancho/enumerate-iam ~/tools/enumerate-iam
cd ~/tools/enumerate-iam && pip3 install -r requirements.txt

# CloudGoat
git clone https://github.com/RhinoSecurityLabs/cloudgoat ~/tools/cloudgoat
cd ~/tools/cloudgoat && pip3 install -r requirements.txt

# CloudMapper
git clone https://github.com/duo-labs/cloudmapper ~/tools/cloudmapper
cd ~/tools/cloudmapper && pip3 install -r requirements.txt

echo "All tools installed!"
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/aws-pentesting/resources.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.