iknowjason

Awesome-CloudSec-Labs

Awesome free cloud native security learning labs. Includes CTF, self-hosted workshops, guided vulnerability labs, and research labs.

PurpleCloud

A little tool to play with Azure Identity - Azure Active Directory lab creation tool

edge

Recon tool for cloud provider attribution. Supports AWS, Azure, Google, Cloudflare, and Digital Ocean.

AutomatedEmulation

An automated Breach and Attack Simulation lab with terraform. Built for IaC stability, consistency, and speed.

AriaCloud

A Docker container for remote penetration testing.

BlueCloud

Cyber Range including Velociraptor + HELK system with a Windows VM for security testing and R&D. Azure and AWS terraform support.

voiphopper

VoIP Hopper Network Penetration Testing Tool - Jumping from one VLAN to the next! A network infrastructure penetration testing security tool. A tool to test for the (in)security of VLANS. It can mimic the behavior of IP Phones to better understand business risks within an IP Telephony network infrastructure. VoIP Hopper is included in Kali Linux. This site is for up-to-date code. Documentation website:

Velociraptor_Azure

A collection of Terraform and Ansible scripts that automatically (and quickly) deploys a small Velociraptor R&D lab.

hammer

An example of a mis-configured Rails application release under MIT license.

masscan_nmap

Automating masscan and nmap together.

CMLab

Configuration Management (CM) Security Playground. A small enterprise security lab to practice automation + CM tooling like Ansible, Chef, Puppet, DSCv2, DSCv3, SaltStack.

azrecon

Az Enum & Recon Cheat Sheet

MacLab

Multi-use Terraform template to quickly spin up a Mac Lab in AWS!

BlueTools

conferences

Community contributions to SANS, DEFCON, ShmooCon, and ToorCon.

enterprise-azure-policy-as-code

Enterprise-ready Azure Policy-as-Code (PaC) solution (includes Az DevOps pipeline)

HELK_Azure

A collection of Terraform and Ansible scripts that automatically (and quickly) deploys a small HELK R&D lab in Azure.

Spray365

Spray365 makes spraying Microsoft accounts (Office 365 / Azure AD) easy through its customizable two-step password spraying approach. The built-in execution plan features options that attempt to bypass Azure Smart Lockout and insecure conditional access policies.

BadBlood

BadBlood by @davidprowe, Secframe.com, fills a Microsoft Active Directory Domain with a structure and thousands of objects. The output of the tool is a domain similar to a domain in the real world. After BadBlood is ran on a domain, security analysts and engineers can practice using tools to gain an understanding and prescribe to securing Active Directory. Each time this tool runs, it produces different results. The domain, users, groups, computers and permissions are different. Every. Single. Time.

for608-dev

HELK

The Hunting ELK

AzureHound

caldera_tines

Samples for Caldera and Tines automation playbooks

logstash-example

Demonstration logstash configuration using a docker-compose

ms-identity-pythonwebapp

panther

Detect threats with log data and improve cloud security posture

saml-pentest

Some python and ruby examples for saml xml manipulation.

SANSSEC598-Resources

Rsources that are publicly available, these resources are linked to the SANS SEC598 Class

SlingshotCE

velociraptor-to-timesketch