Open Source Tools

General Disclaimer

While we do our best to only post reputable tools, we cannot feasibly inspect them all, and so we can't guarantee that they work as advertised. Use at your own risk. If you experience issues with them, please let us know.

• AzureGoat - AzureGoat is a vulnerable by design infrastructure on Azure featuring the latest released OWASP Top 10 web application security risks (2021) and other misconfiguration based on services such as App Functions, CosmosDB, Storage Accounts, Automation and Identities. AzureGoat mimics real-world infrastructure but with added vulnerabilities. It features multiple escalation paths and is focused on a black-box approach.

• ROADtools - Rogue Office 365 and Azure Active Directory Tools - ROADtools is a framework to interact with Azure AD. It consists of a library (roadlib) with common components, the ROADrecon Azure AD exploration tool and the ROADtools Token eXchange (roadtx) tool.

• MicroBurst - MicroBurst includes functions and scripts that support Azure Services discovery, weak configuration auditing, and post exploitation actions such as credential dumping. It is intended to be used during penetration tests where Azure is in use.tool.

• AzureHound - The BloodHound data collector for Microsoft Azure. Use this to analyze attack paths in Azure. Part of the popular BloodhHound framework. More details can be found in this blog: https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350