cloudxpl 4.2.0__py3-none-any.whl

cloudxpl/modules/alibaba/ecs_metadata.py

@@ -0,0 +1,40 @@
+"""CloudXPL-Forge module: SSRF to Alibaba ECS metadata endpoint for RAM role credentials"""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.alibaba.ecs_metadata.v1",
+    "safety_class": "EXPLOIT",
+    "requires_authorization": True,
+    "side_effects": ["api_calls", "state_change"],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1552.005"],
+}
+
+
+def run(args: Any) -> int:
+    """Execute SSRF to Alibaba ECS metadata endpoint for RAM role credentials."""
+    import json
+    import sys
+    from datetime import datetime, timezone
+    from pathlib import Path
+
+    print(f"[*] {MANIFEST['capability_id']} starting...")
+    print(f"[*] Target: {getattr(args, 'target', 'N/A')}")
+
+    findings: list[dict] = []
+
+    # --- Module logic placeholder ---
+    # TODO: implement provider-specific API calls
+    print("[!] Module stub — implement provider-specific logic")
+
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    out_dir = Path(getattr(args, "output", "."))
+    out_dir.mkdir(parents=True, exist_ok=True)
+    out_file = out_dir / f"{MANIFEST['capability_id'].rsplit('.', 1)[-1]}_{ts}.json"
+    out_file.write_text(json.dumps({"module": MANIFEST["capability_id"], "timestamp": ts, "findings": findings}, indent=2))
+    print(f"[+] Results saved to {out_file}")
+    return 0

cloudxpl/modules/alibaba/oss_enum.py

@@ -0,0 +1,40 @@
+"""CloudXPL-Forge module: Enumerate Alibaba OSS buckets, ACLs, policies"""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.alibaba.oss_enum.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": ["api_calls"],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1526"],
+}
+
+
+def run(args: Any) -> int:
+    """Execute Enumerate Alibaba OSS buckets, ACLs, policies."""
+    import json
+    import sys
+    from datetime import datetime, timezone
+    from pathlib import Path
+
+    print(f"[*] {MANIFEST['capability_id']} starting...")
+    print(f"[*] Target: {getattr(args, 'target', 'N/A')}")
+
+    findings: list[dict] = []
+
+    # --- Module logic placeholder ---
+    # TODO: implement provider-specific API calls
+    print("[!] Module stub — implement provider-specific logic")
+
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    out_dir = Path(getattr(args, "output", "."))
+    out_dir.mkdir(parents=True, exist_ok=True)
+    out_file = out_dir / f"{MANIFEST['capability_id'].rsplit('.', 1)[-1]}_{ts}.json"
+    out_file.write_text(json.dumps({"module": MANIFEST["capability_id"], "timestamp": ts, "findings": findings}, indent=2))
+    print(f"[+] Results saved to {out_file}")
+    return 0

cloudxpl/modules/alibaba/oss_exploit.py

@@ -0,0 +1,40 @@
+"""CloudXPL-Forge module: Exploit misconfigured OSS buckets (public read/write, CORS)"""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.alibaba.oss_exploit.v1",
+    "safety_class": "EXPLOIT",
+    "requires_authorization": True,
+    "side_effects": ["api_calls", "state_change"],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1530"],
+}
+
+
+def run(args: Any) -> int:
+    """Execute Exploit misconfigured OSS buckets (public read/write, CORS)."""
+    import json
+    import sys
+    from datetime import datetime, timezone
+    from pathlib import Path
+
+    print(f"[*] {MANIFEST['capability_id']} starting...")
+    print(f"[*] Target: {getattr(args, 'target', 'N/A')}")
+
+    findings: list[dict] = []
+
+    # --- Module logic placeholder ---
+    # TODO: implement provider-specific API calls
+    print("[!] Module stub — implement provider-specific logic")
+
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    out_dir = Path(getattr(args, "output", "."))
+    out_dir.mkdir(parents=True, exist_ok=True)
+    out_file = out_dir / f"{MANIFEST['capability_id'].rsplit('.', 1)[-1]}_{ts}.json"
+    out_file.write_text(json.dumps({"module": MANIFEST["capability_id"], "timestamp": ts, "findings": findings}, indent=2))
+    print(f"[+] Results saved to {out_file}")
+    return 0

cloudxpl/modules/alibaba/ram_enum.py

@@ -0,0 +1,40 @@
+"""CloudXPL-Forge module: Enumerate Alibaba RAM users, roles, policies, access keys"""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.alibaba.ram_enum.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": ["api_calls"],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1087.004"],
+}
+
+
+def run(args: Any) -> int:
+    """Execute Enumerate Alibaba RAM users, roles, policies, access keys."""
+    import json
+    import sys
+    from datetime import datetime, timezone
+    from pathlib import Path
+
+    print(f"[*] {MANIFEST['capability_id']} starting...")
+    print(f"[*] Target: {getattr(args, 'target', 'N/A')}")
+
+    findings: list[dict] = []
+
+    # --- Module logic placeholder ---
+    # TODO: implement provider-specific API calls
+    print("[!] Module stub — implement provider-specific logic")
+
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    out_dir = Path(getattr(args, "output", "."))
+    out_dir.mkdir(parents=True, exist_ok=True)
+    out_file = out_dir / f"{MANIFEST['capability_id'].rsplit('.', 1)[-1]}_{ts}.json"
+    out_file.write_text(json.dumps({"module": MANIFEST["capability_id"], "timestamp": ts, "findings": findings}, indent=2))
+    print(f"[+] Results saved to {out_file}")
+    return 0

cloudxpl/modules/alibaba/rds_enum.py

@@ -0,0 +1,40 @@
+"""CloudXPL-Forge module: Enumerate Alibaba RDS instances, accounts, databases"""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.alibaba.rds_enum.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": ["api_calls"],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1580"],
+}
+
+
+def run(args: Any) -> int:
+    """Execute Enumerate Alibaba RDS instances, accounts, databases."""
+    import json
+    import sys
+    from datetime import datetime, timezone
+    from pathlib import Path
+
+    print(f"[*] {MANIFEST['capability_id']} starting...")
+    print(f"[*] Target: {getattr(args, 'target', 'N/A')}")
+
+    findings: list[dict] = []
+
+    # --- Module logic placeholder ---
+    # TODO: implement provider-specific API calls
+    print("[!] Module stub — implement provider-specific logic")
+
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    out_dir = Path(getattr(args, "output", "."))
+    out_dir.mkdir(parents=True, exist_ok=True)
+    out_file = out_dir / f"{MANIFEST['capability_id'].rsplit('.', 1)[-1]}_{ts}.json"
+    out_file.write_text(json.dumps({"module": MANIFEST["capability_id"], "timestamp": ts, "findings": findings}, indent=2))
+    print(f"[+] Results saved to {out_file}")
+    return 0

cloudxpl/modules/aws/cloudformation_exploit.py

@@ -0,0 +1,61 @@
+"""AWS CloudFormation exploitation — stack secrets, exported values, template analysis."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.cloudformation_exploit.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1552"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS CloudFormation Exploitation Analysis (region: {args.region})")
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    cfn = session.client("cloudformation")
+    results = {"stacks": [], "exports": [], "secrets_in_params": []}
+    try:
+        paginator = cfn.get_paginator("describe_stacks")
+        for page in paginator.paginate():
+            for stack in page["Stacks"]:
+                info = {"name": stack["StackName"], "status": stack["StackStatus"]}
+                for param in stack.get("Parameters", []):
+                    if not param.get("ParameterValue") == "****":
+                        if any(k in param["ParameterKey"].upper() for k in ["SECRET", "PASSWORD", "KEY", "TOKEN"]):
+                            results["secrets_in_params"].append({"stack": stack["StackName"], "param": param["ParameterKey"]})
+                            print(f"  [!] {stack['StackName']}: visible parameter {param['ParameterKey']}")
+                for output in stack.get("Outputs", []):
+                    if output.get("ExportName"):
+                        results["exports"].append({"stack": stack["StackName"], "export": output["ExportName"], "value": output.get("OutputValue", "")[:40]})
+                results["stacks"].append(info)
+    except Exception as exc:
+        print(f"[-] CFN enum failed: {exc}"); return 1
+    _save(args, "aws_cloudformation_exploit", results)
+    print(f"[+] {len(results['stacks'])} stacks, {len(results['exports'])} exports, {len(results['secrets_in_params'])} visible secrets")
+    return 0

cloudxpl/modules/aws/cloudtrail_disable.py

@@ -0,0 +1,66 @@
+"""AWS CloudTrail evasion analysis — identifies trails, logging gaps, tampering vectors."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.cloudtrail_disable.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1562.008"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS CloudTrail Evasion Analysis (region: {args.region})")
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    ct = session.client("cloudtrail")
+    results = {"trails": [], "evasion_vectors": []}
+    try:
+        trails = ct.describe_trails()["trailList"]
+        for trail in trails:
+            info = {"name": trail["Name"], "s3_bucket": trail.get("S3BucketName"), "is_multi_region": trail.get("IsMultiRegionTrail", False), "log_validation": trail.get("LogFileValidationEnabled", False), "is_organization": trail.get("IsOrganizationTrail", False)}
+            try:
+                status = ct.get_trail_status(Name=trail["TrailARN"])
+                info["is_logging"] = status.get("IsLogging", False)
+                if not info["is_logging"]:
+                    results["evasion_vectors"].append({"trail": trail["Name"], "type": "logging_disabled"})
+                    print(f"  [!] {trail['Name']}: LOGGING DISABLED")
+            except Exception: pass
+            if not info["log_validation"]:
+                results["evasion_vectors"].append({"trail": trail["Name"], "type": "no_log_validation"})
+                print(f"  [!] {trail['Name']}: log file validation disabled")
+            try:
+                selectors = ct.get_event_selectors(TrailName=trail["TrailARN"])
+                info["event_selectors"] = len(selectors.get("EventSelectors", []))
+            except Exception: pass
+            results["trails"].append(info)
+    except Exception as exc:
+        print(f"[-] CloudTrail enum failed: {exc}"); return 1
+    _save(args, "aws_cloudtrail_disable", results)
+    print(f"[+] {len(results['trails'])} trails, {len(results['evasion_vectors'])} evasion vectors")
+    return 0

cloudxpl/modules/aws/cloudtrail_tamper.py

@@ -0,0 +1,59 @@
+"""AWS CloudTrail tampering assessment — trail deletion, S3 bucket manipulation."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.cloudtrail_tamper.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1562.008"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS CloudTrail Tamper Assessment (region: {args.region})")
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    ct = session.client("cloudtrail")
+    iam = session.client("iam")
+    sts = session.client("sts")
+    caller = sts.get_caller_identity()
+    results = {"caller": caller["Arn"], "tamper_capabilities": []}
+    try:
+        trails = ct.describe_trails()["trailList"]
+        for trail in trails:
+            caps = {"trail": trail["Name"], "actions": []}
+            try:
+                ct.get_trail_status(Name=trail["TrailARN"])
+                caps["actions"].append("describe")
+            except Exception: pass
+            results["tamper_capabilities"].append(caps)
+            print(f"  [*] Trail: {trail['Name']} — {trail.get('S3BucketName', 'N/A')}")
+    except Exception as exc:
+        print(f"[-] Trail enumeration failed: {exc}"); return 1
+    _save(args, "aws_cloudtrail_tamper", results)
+    return 0

cloudxpl/modules/aws/codebuild_exploit.py

@@ -0,0 +1,62 @@
+"""AWS CodeBuild exploitation — env var extraction, buildspec secrets."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.codebuild_exploit.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1552"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS CodeBuild Exploitation Analysis (region: {args.region})")
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    cb = session.client("codebuild")
+    results = {"projects": [], "secrets_found": []}
+    try:
+        projects = cb.list_projects()["projects"]
+        for pname in projects:
+            proj = cb.batch_get_projects(names=[pname])["projects"][0]
+            info = {"name": pname, "source_type": proj.get("source", {}).get("type"), "service_role": proj.get("serviceRole")}
+            env_vars = proj.get("environment", {}).get("environmentVariables", [])
+            for ev in env_vars:
+                if ev.get("type") == "PLAINTEXT" and any(k in ev["name"].upper() for k in ["KEY", "SECRET", "TOKEN", "PASSWORD"]):
+                    results["secrets_found"].append({"project": pname, "var_name": ev["name"], "type": "plaintext"})
+                    print(f"  [!] {pname}: plaintext secret in env var {ev['name']}")
+                elif ev.get("type") == "PARAMETER_STORE":
+                    info.setdefault("param_store_refs", []).append(ev["name"])
+                elif ev.get("type") == "SECRETS_MANAGER":
+                    info.setdefault("secrets_manager_refs", []).append(ev["name"])
+            results["projects"].append(info)
+    except Exception as exc:
+        print(f"[-] CodeBuild enum failed: {exc}"); return 1
+    _save(args, "aws_codebuild_exploit", results)
+    print(f"[+] {len(results['projects'])} projects, {len(results['secrets_found'])} plaintext secrets")
+    return 0

cloudxpl/modules/aws/codepipeline_exploit.py

@@ -0,0 +1,62 @@
+"""AWS CodePipeline exploitation — pipeline enumeration, artifact manipulation vectors."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.codepipeline_exploit.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1195.002"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS CodePipeline Analysis (region: {args.region})")
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    cp = session.client("codepipeline")
+    results = {"pipelines": []}
+    try:
+        pipelines = cp.list_pipelines()["pipelines"]
+        for pl in pipelines:
+            info = {"name": pl["name"], "created": str(pl.get("created", ""))}
+            try:
+                detail = cp.get_pipeline(name=pl["name"])["pipeline"]
+                info["stages"] = len(detail.get("stages", []))
+                info["role"] = detail.get("roleArn", "")
+                for stage in detail.get("stages", []):
+                    for action in stage.get("actions", []):
+                        if action.get("actionTypeId", {}).get("provider") in ("GitHub", "CodeCommit", "S3"):
+                            info.setdefault("sources", []).append(action["actionTypeId"]["provider"])
+            except Exception: pass
+            results["pipelines"].append(info)
+            print(f"  [+] {pl['name']} ({info.get('stages', '?')} stages)")
+    except Exception as exc:
+        print(f"[-] CodePipeline enum failed: {exc}"); return 1
+    _save(args, "aws_codepipeline_exploit", results)
+    print(f"[+] {len(results['pipelines'])} pipelines found")
+    return 0

cloudxpl/modules/aws/cognito_exploit.py

@@ -0,0 +1,71 @@
+"""AWS Cognito exploitation — user pool misconfiguration, identity pool abuse."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.cognito_exploit.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1078"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS Cognito Exploitation Analysis (region: {args.region})")
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    cognito = session.client("cognito-idp")
+    cognito_id = session.client("cognito-identity")
+    results = {"user_pools": [], "identity_pools": [], "misconfigurations": []}
+    try:
+        pools = cognito.list_user_pools(MaxResults=60)["UserPools"]
+        for pool in pools:
+            pid = pool["Id"]
+            desc = cognito.describe_user_pool(UserPoolId=pid)["UserPool"]
+            info = {"id": pid, "name": desc["Name"], "mfa": desc.get("MfaConfiguration", "OFF"), "self_signup": desc.get("Policies", {}).get("SignUpPolicy", {}).get("AllowAdminCreateUserOnly") is False}
+            if info["self_signup"]:
+                results["misconfigurations"].append({"pool": pid, "type": "self_signup_enabled"})
+                print(f"  [!] {desc['Name']}: self-signup enabled")
+            if info["mfa"] == "OFF":
+                results["misconfigurations"].append({"pool": pid, "type": "mfa_disabled"})
+                print(f"  [!] {desc['Name']}: MFA disabled")
+            results["user_pools"].append(info)
+    except Exception as exc:
+        print(f"[-] User pool enum failed: {exc}")
+    try:
+        id_pools = cognito_id.list_identity_pools(MaxResults=60)["IdentityPools"]
+        for ip in id_pools:
+            desc = cognito_id.describe_identity_pool(IdentityPoolId=ip["IdentityPoolId"])
+            info = {"id": ip["IdentityPoolId"], "name": ip["IdentityPoolName"], "allow_unauth": desc.get("AllowUnauthenticatedIdentities", False)}
+            if info["allow_unauth"]:
+                results["misconfigurations"].append({"pool": ip["IdentityPoolId"], "type": "unauth_access_enabled"})
+                print(f"  [!] {ip['IdentityPoolName']}: unauthenticated access enabled")
+            results["identity_pools"].append(info)
+    except Exception: pass
+    _save(args, "aws_cognito_exploit", results)
+    print(f"[+] {len(results['user_pools'])} user pools, {len(results['identity_pools'])} identity pools, {len(results['misconfigurations'])} misconfigs")
+    return 0

cloudxpl/modules/aws/cve_2024_28056.py

@@ -0,0 +1,59 @@
+"""CVE-2024-28056 Amplify IAM role assumption PoC."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.cve_2024_28056.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1190"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print("[*] CVE-2024-28056: AWS Amplify IAM Role Assumption")
+    print("[*] Vulnerability: Amplify creates IAM roles with overly permissive trust policies")
+    print("[*] Impact: Attacker can assume Amplify-provisioned roles from any AWS account")
+    results = {"cve": "CVE-2024-28056", "cvss": 9.8, "status": "checking"}
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    iam = session.client("iam")
+    try:
+        paginator = iam.get_paginator("list_roles")
+        amplify_roles = []
+        for page in paginator.paginate():
+            for role in page["Roles"]:
+                if "amplify" in role["RoleName"].lower() or "amplify" in str(role.get("AssumeRolePolicyDocument", {})).lower():
+                    trust = role.get("AssumeRolePolicyDocument", {})
+                    amplify_roles.append({"name": role["RoleName"], "arn": role["Arn"], "trust": trust})
+                    print(f"  [+] Amplify role: {role['RoleName']}")
+        results["amplify_roles"] = amplify_roles
+        results["status"] = "vulnerable" if amplify_roles else "not_affected"
+    except Exception as exc:
+        results["status"] = f"error: {exc}"
+    _save(args, "aws_cve_2024_28056", results)
+    return 0