cloud-iam-deep
聚焦外部可利用路径与凭证滥用链条，适合云环境入侵后权限评估与横向移动。
包含云服务凭证滥用与权限提升技术，具有高滥用风险，需严格合规测试。
跨 AWS/Azure/GCP 的云 IAM 漏洞链与凭证发现后的一站式分析流程。
当出现云凭证、SSRF、IMDS 暴露或 K8s token 泄露时，做一套跨 AWS/Azure/GCP 的 IAM 攻击链与提权分析，涵盖 IAM 枚举、STS/AssumeRole 链接、Managed Identity/服务账号滥用等场景。适合在凭证发现或云主机后渗透评估阶段快速找出可利用的提权路径和横向移动机会。侧重外部利用链和可操作的提权模式。
▸ 展开 SKILL.md 英文原文
Cloud IAM red-team attack chain across AWS, Azure, GCP — focused on EXTERNAL exploitation paths and post-credential-discovery privilege analysis. Covers IAM enumeration (aws iam, az role, gcloud iam), STS/AssumeRole chaining, Azure Managed Identity abuse (via SSRF/leak), GCP service account JSON abuse, IMDSv1/v2 attacks via SSRF, K8s ServiceAccount token privilege analysis once held (token discovery / cluster exposure is owned by hunt-k8s), role-trust-policy confused-deputy, cross-account assume-role enumeration, IAM privilege escalation patterns (24+ AWS, 8+ Azure, 6+ GCP), and AWS Cognito Identity Pool unauthenticated-role attack chain (GetId → GetCredentialsForIdentity → IAM role abuse). Built for the case where recon yields a credential (key, JSON, token) and you need to know what it grants and how to escalate. Use when an AWS key / Azure secret / GCP service account JSON / K8s SA token surfaces from a code repo, JS bundle, APK, breach corpus, or SSRF chain.
帮我安装这个 skill：https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/cloud-iam-deep/SKILL.mdcurl -fsSL "https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/cloud-iam-deep/SKILL.md"## When to use
Trigger when:
- A cloud credential surfaces (key, secret, token, JSON file)
- SSRF chain reaches IMDS / metadata endpoint
- APK / git-leak reveals embedded cloud key
- Recon shows public S3/GCS/Azure-blob with permissions you can verify
- A Kubernetes API or service-account token is exposed
- Post-RCE on a cloud-hosted instance — pivot to cloud control plane
Do NOT use for:
- On-prem-only environments (use AD attack skills — but those are out of scope per external-only boundary)
- Web2 vulns that happen to be on AWS — use the relevant `hunt-*` skill
---
## Credential identification (first 60 seconds)
```bash
# AWS access key patterns
AKIA[0-9A-Z]{16} # IAM