Cloud Security Resources

All Cloud Security Resources

10 Of The Best Cloud Security Podcasts

Divio publishes a great list of podcasts will links and descriptions here.

A Cloud Guru

Now owned by Pluralsight, A Cloud Guru is still an amazing resource for all kinds of cloud skills and certification training.

AIGoat : A Deliberately Vulnerable AI Infrastructure (Orca Research)

AI-Goat is a deliberately vulnerable AI infrastructure hosted on AWS, designed to simulate the OWASP Machine Learning Security Top 10 risks

Amazon EKS Workshop

Practical exercises to learn about Amazon Elastic Kubernetes Service

Analyzing Malicious Documents

This cheat sheet outlines tips and tools for analyzing malicious documents, such as Microsoft Office, RTF, and PDF files.

Attacking and Defending Serverless Applications

Awesome Malware Analysis

A curated list of awesome malware analysis tools and resources.

Awesome-docker

A curated list of Docker resources and projects

AWS Certified Cloud Practitioner

This is a good starting point on the AWS Certification journey for individuals with no prior IT or cloud experience switching to a cloud career or for line-of-business employees looking for foundational cloud literacy.

AWS Certified Solutions Architect - Associate Exam Guide

AWS Certified Solutions Architect - Associate showcases knowledge and skills in AWS technology, across a wide range of AWS services.

AWS Certified Solutions Architect - Professional

AWS Certified Solutions Architect - Professional is intended for individuals with two or more years of hands-on experience designing and deploying cloud architecture on AWS.

AWS Certified Solutions Architect - Professional Exam Guide

Exam guide for the AWS Certified Solutions Architect - Professional (SAP-C02)

AWS Well Architected Framework

Learn, measure, and build using architectural best practices according the the AWS Well Architected Framework

BADZURE

BadZure was initialy written to host the Azure AD Battle School: Hands-on Attack and Defense workshop at X33fcon 2023.

Binary Edge

Binary Edge scans the entire public internet, create real-time threat intelligence streams, and reports that show the exposure of what is connected to the Internet.

Breaching the Cloud with Beau Bullock

This course provides comprehensive insights into cloud-based attack surfaces, a step-by-step methodology for compromising cloud environments, and practical guidance on leveraging open-source tools for effective cloud assessments.

BrokenbyDesign

This app will test your hacking skills in the Azure cloud space.

Build Kubernetes bare metal cluster

An easy-to-follow guide to get your first cluster and application up and running

Bust-A-Kube

Bust-A-Kube is an intentionally-vulnerable Kubernetes cluster, intended to help people self-train on attacking and defending Kubernetes clusters.

CBT Nuggets

Expert IT training — when and where you need it.

Certbot

Certbot is a free, open source software tool for automatically using Let’s Encrypt certificates on manually-administrated websites to enable HTTPS.

CI/CDON'T

This is an AWS/GitLab CI/CD themed CTF that you can run in your own AWS account.

Cloud Katana

Cloud Katana is a cloud native tool developed from the need to automate the execution of simulation steps in multi-cloud and hybrid cloud environments.

Cloud Security Lab A Week

One cloudsec lab. 15-30 minutes. Every week.

Cloud Security Training (with puppies!)

cloudfoxable

A Gamified Cloud Hacking Sandbox

CloudGOAT

CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool. It allows you to hone your cloud cybersecurity skills by creating and completing several "capture-the-flag" style scenarios.

CloudSec Tidbits

CloudSec Tidbits is a blogpost series showcasing interesting bugs found by Doyensec during cloud security testing activities.

cloudvulndb

An open project to list all known cloud vulnerabilities and CSP security issues

CNAPPgoat

CNAPPgoat is a multi-cloud, vulnerable-by-design environment deployment tool – specifically engineered to facilitate practice arenas for defenders and pentesters.

Code Beautify

Code Formatter, JSON Beautifier, XML Viewer, Hex Converters and more...

Cybersecurity Stash

A curated directory of cybersecurity tools and resources for infosec professionals.

Cybersecurity-related Podcasts

17 best cybersecurity-related podcasts, according to SANS

Dehashed

Leaked Credentials

direnv

direnv is an extension for your shell. It augments existing shells with a new feature that can load and unload environment variables depending on the current directory.

Dive Into Ansible

Dive Into Ansible course by James Spurin

DNSDumpster

DNS recon & research, find & lookup DNS records

Dorksearch

Google dorks are special search terms that are used to access specific sets of information that are not available with normal queries.

DVWA

Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable.

eksctl

eksctl is a simple CLI tool for creating and managing clusters on EKS - Amazon's managed Kubernetes service for EC2.

exploit-db

Exploit Database - Exploits for Penetration Testers, Researchers, and Ethical Hackers

FLAWS

Through a series of levels you'll learn about common mistakes and gotchas when using Amazon Web Services (AWS).

FLAWS 2

Similar to the original flAWS.cloud this game/tutorial teaches you AWS (Amazon Web Services) security concepts.

Forefront AI

A better way to run & fine-tune open-source models on your data. Your data, your models, your AI.

GCP GOAT

GCP-Goat is intentionally vulnerable GCP environment to learn and practice GCP Security

GCP Online Boutique

Deploy a demonstration microservices app on GCP.

GitHub Actions Goat

GitHub Actions Goat: Deliberately Vulnerable GitHub Actions CI/CD Environment

Google Cloud Skills Boost

Upskill yourself or your team with Google Cloud Skills Boost. From beginners to experts, find the credentials and trainings you need to achieve your goals.

grayhat warfare

displays thousands of publicly accessible S3 buckets

grep.app

Search across a half million git repos

Homebrew

Homebrew installs the stuff you need that Apple (or your Linux system) didn’t. It is indispensable, and you don't even need root privileges to use it to install binaries in your user environment.

How to Learn Linux

How to Learn Linux? (from Zero to Hero), a guide for learning Linux

IAM Vulnerable

IAM Vulnerable uses the Terraform binary and your AWS credentials to deploy over 250 IAM resources into your selected AWS account.

Install and Configure Cert Manager on EKS

A guide explains provisioning certificates for your EKS / Kubernetes Cluster.

IPTABLES HOWTO

Basic iptables howto Iptables is a firewall, installed by default on all official Ubuntu distributions (Ubuntu, Kubuntu, Xubuntu).

Kube Security Lab

Kubernetes Local Security Testing Lab

Kubernetes The Hard Way

This tutorial walks you through setting up Kubernetes the hard way. This guide is not for someone looking for a fully automated tool to bring up a Kubernetes cluster.

LeakiX

LeakIX is a red-team search engine indexing mis-configurations and vulnerabilities online.

Linux Logging Basics

Ultimate Guide to Logging - Your open-source resource for understanding, analyzing, and troubleshooting system logs

Linux Logging Basics

What Linux logs are, where they’re located, and how to interpret them.

Linux Survival Guide

Linux Survival is a free tutorial designed to make it as easy as possible to learn Linux.

Microsoft Learn

All about Microsoft credentials

minikube

minikube quickly sets up a local Kubernetes cluster on macOS, Linux, and Windows. It's a fast, free and easy way to play with a local Kubernetes cluster.

Multi Cloud CLI

Use CLIs to interact with the three most popular cloud platforms: Amazon Web Services (AWS), Microsoft Azure, and the Google Cloud Platform (GCP)

Multicloud Cheat Sheet

This comprehensive multicloud cheat sheet covers multicloud use cases, top vendors, benefits, pros, cons and more.

Offensive Security Bookmarks

A security bookmarks collection. All that things needed to pass OSCP, maybe

OpenCTI Install HowTo Guide

Self-Hosted Open Source Threat Intelligence platform

OWASP

The OWASP® Foundation works to improve the security of software through its community-led open source software projects, hundreds of chapters worldwide, tens of thousands of members, and by hosting local and global conferences.

Packet Storm

Packet Storm provides around-the-clock information and tools in order to help mitigate both personal data and fiscal loss on a global scale.

Pentest Monkey

Taking the monkey work out of pentesting

Pivot Atlas

An educational pivoting handbook for cyber threat intelligence analysts developed by Amitai Cohen.

Play With Kubernetes

A simple, interactive and fun playground to learn Kubernetes

PublicWWW

Find any alphanumeric snippet, signature or keyword in the web pages HTML, JS and CSS code.

Pulsedive

Search any domain, IP, or URL and enrich on-demand with passive and active scans to inform your investigation.

Pwned Labs

Rego Playground

OPA is a General Purpose Open Source Policy Engine, and Rego is the language it uses. This is a playground to learn how to write Rego.

Rock Your Resume

Quickly compare your resume to a job and receive a snapshot of how well you match and guidance to make critical improvements before you apply.

SANS Cloud Wars

Find vulnerabilities in this application before it finds its way into production. Also, ensure that proper logging is in place to allow analysts to identify attackers abusing this application.

searchcode

Helping you find real world examples of functions, API's and libraries in 243 languages across 10+ public code sources

Security Certification Roadmap

Incredibly useful interactive map of security certifications.

Security Trails

DNS data lookup

Shodan

Shodan is the world's first search engine for Internet-connected devices.

T-Pot - The All In One Multi Honeypot Platform

T-Pot is the all in one, optionally distributed, multiarch (amd64, arm64) honeypot plattform, supporting 20+ honeypots and countless visualization options using the Elastic Stack, animated live attack maps and lots of security tools to further improve the deception experience.