cloud

A browser-based tool for authorized post-compromise operations against Microsoft 365 and Entra ID: it stores and switches between access/refresh tokens and Primary Refresh Tokens, runs device-code flows, browses OneDrive/SharePoint/Outlook/Teams data, enumerates users and roles, and issues arbitrary Microsoft Graph requests. It also supports adding MFA methods (TOTP, FIDO, phone) for account persistence.

An open-source AWS exploitation framework by Rhino Security Labs with a modular architecture for enumeration, privilege escalation, IAM user backdooring, Lambda exploitation, lateral movement, data exfiltration, and log manipulation. It tracks enumerated data in a local SQLite database and logs commands for audit trails.

SpecterOps's Go data collector that enumerates Microsoft Azure/Entra tenant data and formats it for BloodHound to map attack paths and privilege-escalation routes. It supports multiple auth methods (username/password, JWT, refresh tokens, Azure CLI), runs as a CLI or persistent service, and ships cross-platform binaries.

Rhino Security Labs' 'vulnerable by design' AWS/Azure deployment tool with CTF-style cloud attack scenarios.