Tagged cloud-security

Assess SAML, OIDC and OAuth2 single sign-on setups for misconfigurations

Abuse AD CS ESC1 misconfigurations to request certificates as privileged users

Find and exploit AD CS ESC1 to ESC16 misconfigurations with Certipy

Find OAuth and OIDC flaws in redirect URIs, token leakage and code theft

Run Datadog Cloud SIEM and Workload Protection to detect threats and misconfigurations

Assess AD posture with PingCastle, BloodHound and Purple Knight for misconfigurations

Find IAM misconfigurations that let users escalate privileges with Pacu and CloudFox

Enumerate Linux misconfigurations, SUID binaries and kernel flaws to reach root

Find CORS misconfigurations that let other origins read authenticated responses

Audit TLS setups for downgrade attacks and misconfigurations like POODLE and DROWN

Scan Android APKs for open Firebase databases, buckets and auth misconfigurations

Enumerate AWS IAM policies and map 21 known privilege escalation primitives

Enumerate cloud buckets, metadata endpoints and IAM misconfigurations

Test CORS misconfigurations for reflected origins and credentialed data theft

Test reverse proxy misconfigurations like nginx alias traversal and exposed actuators

Hunt CORS misconfigurations that allow credentialed cross-origin reads

Hunt TLS, HSTS, SPF and DNS misconfigurations that enable spoofing

Pentest Azure, AWS, GCP and O365 for misconfigurations and exposed secrets

Guide authorized cloud security tests for IAM, storage, metadata and serverless flaws

Map Active Directory ACL misconfigurations and attack paths in authorized tests

Test CORS settings for origin reflection, credentialed reads and preflight bugs

Review OAuth and OIDC redirect URIs, PKCE, state and nonce handling for flaws

Answer G-Cloud supplier questions on certificates like Cyber Essentials and ISO 27001

Scan Claude Code configs, hooks and MCP servers for injection and misconfiguration risks

Find CORS misconfigurations that let other origins read sensitive API data

Pentest Huawei Cloud IAM, ECS, OBS and container services for misconfigurations

Scan web servers for outdated software, dangerous files and misconfigurations with Nikto

Check targets against thousands of Nuclei templates for CVEs and misconfigurations

Hunt API misconfigurations like mass assignment, JWT attacks and prototype pollution

Scan container images for CVEs and misconfigurations with Trivy and Grype

Write AWS IAM policies, cross-account roles and fix permission errors