vamp-azure-audit 1.0__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- vamp_azure_audit-1.0/PKG-INFO +241 -0
- vamp_azure_audit-1.0/README.md +220 -0
- vamp_azure_audit-1.0/pyproject.toml +36 -0
- vamp_azure_audit-1.0/setup.cfg +4 -0
- vamp_azure_audit-1.0/vamp_azure_audit.egg-info/PKG-INFO +241 -0
- vamp_azure_audit-1.0/vamp_azure_audit.egg-info/SOURCES.txt +9 -0
- vamp_azure_audit-1.0/vamp_azure_audit.egg-info/dependency_links.txt +1 -0
- vamp_azure_audit-1.0/vamp_azure_audit.egg-info/entry_points.txt +2 -0
- vamp_azure_audit-1.0/vamp_azure_audit.egg-info/requires.txt +2 -0
- vamp_azure_audit-1.0/vamp_azure_audit.egg-info/top_level.txt +1 -0
- vamp_azure_audit-1.0/vamp_azure_audit.py +1653 -0
|
@@ -0,0 +1,241 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: vamp-azure-audit
|
|
3
|
+
Version: 1.0
|
|
4
|
+
Summary: Microsoft Azure security auditor for authorized assessments
|
|
5
|
+
Author-email: VampSecure Studios <contact@vampsecurestudios.com>
|
|
6
|
+
License: MIT
|
|
7
|
+
Project-URL: Homepage, https://github.com/Vampsecure-Labs/vamp-azure-audit
|
|
8
|
+
Project-URL: Repository, https://github.com/Vampsecure-Labs/vamp-azure-audit
|
|
9
|
+
Keywords: security,pentest,audit,cybersecurity,vampsecure,azure,cloud,iam,microsoft
|
|
10
|
+
Classifier: Development Status :: 5 - Production/Stable
|
|
11
|
+
Classifier: Environment :: Console
|
|
12
|
+
Classifier: Intended Audience :: Information Technology
|
|
13
|
+
Classifier: License :: OSI Approved :: MIT License
|
|
14
|
+
Classifier: Operating System :: OS Independent
|
|
15
|
+
Classifier: Programming Language :: Python :: 3
|
|
16
|
+
Classifier: Topic :: Security
|
|
17
|
+
Requires-Python: >=3.9
|
|
18
|
+
Description-Content-Type: text/markdown
|
|
19
|
+
Requires-Dist: aiohttp>=3.9.0
|
|
20
|
+
Requires-Dist: rich>=13.7.0
|
|
21
|
+
|
|
22
|
+
# vamp-azure-audit
|
|
23
|
+
|
|
24
|
+
**Microsoft Azure Security Auditor — VampSecure Labs Security Research Division**
|
|
25
|
+
|
|
26
|
+
Herramienta CLI de auditoría de seguridad para entornos Microsoft Azure. Detecta misconfiguraciones críticas en IAM, Storage Accounts, AKS, App Services, Network Security Groups, Key Vault y Microsoft Defender for Cloud utilizando exclusivamente la REST API oficial de Azure (sin SDKs pesados).
|
|
27
|
+
|
|
28
|
+
> **USO EXCLUSIVO EN ENTORNOS CON AUTORIZACIÓN EXPRESA.**
|
|
29
|
+
> Esta herramienta está diseñada para evaluaciones de seguridad autorizadas. Su uso en entornos sin autorización puede ser ilegal.
|
|
30
|
+
|
|
31
|
+
---
|
|
32
|
+
|
|
33
|
+
## Instalación
|
|
34
|
+
|
|
35
|
+
```bash
|
|
36
|
+
pip install vamp-azure-audit
|
|
37
|
+
```
|
|
38
|
+
|
|
39
|
+
O desde el repositorio:
|
|
40
|
+
|
|
41
|
+
```bash
|
|
42
|
+
git clone https://github.com/Vampsecure-Labs/vamp-azure-audit
|
|
43
|
+
cd vamp-azure-audit
|
|
44
|
+
pip install -e .
|
|
45
|
+
```
|
|
46
|
+
|
|
47
|
+
**Dependencias:** `aiohttp>=3.9.0`, `rich>=13.7.0`, Python 3.9+
|
|
48
|
+
|
|
49
|
+
---
|
|
50
|
+
|
|
51
|
+
## Configuración
|
|
52
|
+
|
|
53
|
+
El Service Principal necesita los siguientes permisos:
|
|
54
|
+
|
|
55
|
+
- **Management API:** rol `Reader` en la suscripción + `Microsoft.Security/pricings/read`
|
|
56
|
+
- **Microsoft Graph:** `User.Read.All` (para detección de usuarios Guest con privilegios)
|
|
57
|
+
|
|
58
|
+
Crear Service Principal con rol Reader:
|
|
59
|
+
|
|
60
|
+
```bash
|
|
61
|
+
az ad sp create-for-rbac --name "vamp-azure-audit" --role "Reader" \
|
|
62
|
+
--scopes /subscriptions/<SUBSCRIPTION_ID>
|
|
63
|
+
```
|
|
64
|
+
|
|
65
|
+
---
|
|
66
|
+
|
|
67
|
+
## Variables de entorno
|
|
68
|
+
|
|
69
|
+
| Variable | Descripción |
|
|
70
|
+
|-------------------------|--------------------------------------------------|
|
|
71
|
+
| `AZURE_SUBSCRIPTION_ID` | ID de la suscripción Azure a auditar |
|
|
72
|
+
| `AZURE_TENANT_ID` | ID del tenant de Azure (Directory ID) |
|
|
73
|
+
| `AZURE_CLIENT_ID` | Application (client) ID del Service Principal |
|
|
74
|
+
| `AZURE_CLIENT_SECRET` | Secreto del Service Principal |
|
|
75
|
+
|
|
76
|
+
---
|
|
77
|
+
|
|
78
|
+
## Uso
|
|
79
|
+
|
|
80
|
+
### Auditoría completa (todos los módulos)
|
|
81
|
+
|
|
82
|
+
```bash
|
|
83
|
+
export AZURE_SUBSCRIPTION_ID="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
|
|
84
|
+
export AZURE_TENANT_ID="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
|
|
85
|
+
export AZURE_CLIENT_ID="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
|
|
86
|
+
export AZURE_CLIENT_SECRET="tu-secreto"
|
|
87
|
+
|
|
88
|
+
vamp-azure-audit
|
|
89
|
+
```
|
|
90
|
+
|
|
91
|
+
### Con flags explícitos
|
|
92
|
+
|
|
93
|
+
```bash
|
|
94
|
+
vamp-azure-audit \
|
|
95
|
+
--subscription-id "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" \
|
|
96
|
+
--tenant-id "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" \
|
|
97
|
+
--client-id "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" \
|
|
98
|
+
--client-secret "tu-secreto"
|
|
99
|
+
```
|
|
100
|
+
|
|
101
|
+
### Módulos específicos
|
|
102
|
+
|
|
103
|
+
```bash
|
|
104
|
+
# Solo IAM y NSG
|
|
105
|
+
vamp-azure-audit --modulos iam nsg
|
|
106
|
+
|
|
107
|
+
# Solo Storage y Key Vault
|
|
108
|
+
vamp-azure-audit --modulos storage keyvault
|
|
109
|
+
|
|
110
|
+
# Solo Defender for Cloud
|
|
111
|
+
vamp-azure-audit --modulos defender
|
|
112
|
+
```
|
|
113
|
+
|
|
114
|
+
### Exportar informes
|
|
115
|
+
|
|
116
|
+
```bash
|
|
117
|
+
# Generar informe HTML
|
|
118
|
+
vamp-azure-audit --output-html informe-azure.html
|
|
119
|
+
|
|
120
|
+
# Generar JSON para integración con otras herramientas
|
|
121
|
+
vamp-azure-audit --output-json hallazgos.json
|
|
122
|
+
|
|
123
|
+
# HTML + JSON en el mismo pase
|
|
124
|
+
vamp-azure-audit --output-html informe.html --output-json hallazgos.json
|
|
125
|
+
```
|
|
126
|
+
|
|
127
|
+
---
|
|
128
|
+
|
|
129
|
+
## Módulos disponibles
|
|
130
|
+
|
|
131
|
+
| Módulo | Flag | Descripción |
|
|
132
|
+
|---------------|----------------|-------------------------------------------------------------------|
|
|
133
|
+
| IAM | `iam` | Roles privilegiados a nivel de suscripción, usuarios Guest |
|
|
134
|
+
| Storage | `storage` | Acceso público a blobs, HTTP, TLS, restricciones de red |
|
|
135
|
+
| AKS | `aks` | RBAC, API server público, NetworkPolicy, versiones desactualizadas|
|
|
136
|
+
| App Services | `appservices` | HTTPS, remote debugging, TLS, FTP sin cifrar |
|
|
137
|
+
| NSG | `nsg` | Puertos críticos expuestos a Internet, reglas abiertas |
|
|
138
|
+
| Key Vault | `keyvault` | Soft Delete, Purge Protection, acceso de red |
|
|
139
|
+
| Defender | `defender` | Planes de Defender for Cloud, contacto de seguridad |
|
|
140
|
+
|
|
141
|
+
---
|
|
142
|
+
|
|
143
|
+
## Hallazgos detectados
|
|
144
|
+
|
|
145
|
+
| ID | Severidad | Descripción |
|
|
146
|
+
|----------------|-----------|------------------------------------------------------------|
|
|
147
|
+
| AZURE-IAM-001 | CRITICAL | Usuario con Owner/Contributor a nivel de suscripción |
|
|
148
|
+
| AZURE-IAM-002 | HIGH | Service Principal con Owner a nivel de suscripción |
|
|
149
|
+
| AZURE-IAM-003 | HIGH | Usuario Guest con roles privilegiados |
|
|
150
|
+
| AZURE-STOR-001 | HIGH | Acceso público a blobs habilitado |
|
|
151
|
+
| AZURE-STOR-002 | HIGH | Tráfico HTTP (sin cifrar) permitido |
|
|
152
|
+
| AZURE-STOR-003 | MEDIUM | Sin restricciones de red en Storage Account |
|
|
153
|
+
| AZURE-STOR-004 | MEDIUM | TLS mínimo inferior a 1.2 |
|
|
154
|
+
| AZURE-AKS-001 | CRITICAL | RBAC desactivado en clúster AKS |
|
|
155
|
+
| AZURE-AKS-002 | HIGH | API server de AKS accesible públicamente |
|
|
156
|
+
| AZURE-AKS-003 | HIGH | Sin NetworkPolicy configurada |
|
|
157
|
+
| AZURE-AKS-004 | MEDIUM | Versión de Kubernetes desactualizada |
|
|
158
|
+
| AZURE-APP-001 | HIGH | App Service no fuerza HTTPS |
|
|
159
|
+
| AZURE-APP-002 | HIGH | Remote debugging habilitado |
|
|
160
|
+
| AZURE-APP-003 | MEDIUM | TLS mínimo inferior a 1.2 en App Service |
|
|
161
|
+
| AZURE-APP-004 | MEDIUM | FTP sin cifrar habilitado |
|
|
162
|
+
| AZURE-NSG-001 | CRITICAL | Puerto crítico expuesto a Internet (0.0.0.0/0) |
|
|
163
|
+
| AZURE-NSG-002 | CRITICAL | Regla NSG permite todo el tráfico entrante |
|
|
164
|
+
| AZURE-KV-001 | HIGH | Soft Delete no habilitado en Key Vault |
|
|
165
|
+
| AZURE-KV-002 | MEDIUM | Purge Protection no habilitado |
|
|
166
|
+
| AZURE-KV-003 | HIGH | Key Vault accesible desde cualquier red |
|
|
167
|
+
| AZURE-KV-004 | HIGH | Acceso público habilitado sin restricciones |
|
|
168
|
+
| AZURE-DEF-001 | HIGH | Microsoft Defender no activo para un servicio |
|
|
169
|
+
| AZURE-DEF-002 | MEDIUM | Sin contacto de seguridad configurado |
|
|
170
|
+
|
|
171
|
+
---
|
|
172
|
+
|
|
173
|
+
## Ejemplo de salida
|
|
174
|
+
|
|
175
|
+
```
|
|
176
|
+
██╗ ██╗ █████╗ ███╗ ███╗██████╗
|
|
177
|
+
██║ ██║██╔══██╗████╗ ████║██╔══██╗
|
|
178
|
+
██║ ██║███████║██╔████╔██║██████╔╝
|
|
179
|
+
╚██╗ ██╔╝██╔══██║██║╚██╔╝██║██╔═══╝
|
|
180
|
+
╚████╔╝ ██║ ██║██║ ╚═╝ ██║██║
|
|
181
|
+
╚═══╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚═╝
|
|
182
|
+
|
|
183
|
+
vamp-azure-audit v1.0 — Azure Security Auditor
|
|
184
|
+
VampSecure Labs Security Research Division
|
|
185
|
+
|
|
186
|
+
→ Autenticando en Azure...
|
|
187
|
+
✓ Token Management API obtenido
|
|
188
|
+
✓ Token Microsoft Graph obtenido
|
|
189
|
+
|
|
190
|
+
→ Auditando IAM / Roles...
|
|
191
|
+
⚠ 2 hallazgo(s) (1 CRITICAL) (1 HIGH)
|
|
192
|
+
→ Auditando Storage Accounts...
|
|
193
|
+
⚠ 3 hallazgo(s) (2 HIGH)
|
|
194
|
+
→ Auditando Network Security Groups...
|
|
195
|
+
⚠ 1 hallazgo(s) (1 CRITICAL)
|
|
196
|
+
...
|
|
197
|
+
|
|
198
|
+
╭─ Resumen de Auditoría ──────────────────────╮
|
|
199
|
+
│ Calificación global: D │
|
|
200
|
+
│ │
|
|
201
|
+
│ 🔴 Critical: 2 🟠 High: 5 🟡 Medium: 4│
|
|
202
|
+
│ │
|
|
203
|
+
│ Total hallazgos: 11 Duración: 8.3s │
|
|
204
|
+
╰─────────────────────────────────────────────╯
|
|
205
|
+
```
|
|
206
|
+
|
|
207
|
+
---
|
|
208
|
+
|
|
209
|
+
## Códigos de salida
|
|
210
|
+
|
|
211
|
+
| Código | Significado |
|
|
212
|
+
|--------|--------------------------------------------------|
|
|
213
|
+
| `0` | Sin hallazgos CRITICAL ni HIGH |
|
|
214
|
+
| `1` | Hallazgos HIGH detectados (sin CRITICAL) |
|
|
215
|
+
| `2` | Hallazgos CRITICAL detectados |
|
|
216
|
+
|
|
217
|
+
Útil para integración en pipelines CI/CD:
|
|
218
|
+
|
|
219
|
+
```bash
|
|
220
|
+
vamp-azure-audit --output-json hallazgos.json
|
|
221
|
+
if [ $? -eq 2 ]; then
|
|
222
|
+
echo "BLOQUEADO: Hallazgos críticos en Azure"
|
|
223
|
+
exit 1
|
|
224
|
+
fi
|
|
225
|
+
```
|
|
226
|
+
|
|
227
|
+
---
|
|
228
|
+
|
|
229
|
+
## Licencia
|
|
230
|
+
|
|
231
|
+
MIT License — Copyright © VampSecure Studios — VampSecure Labs Security Research Division
|
|
232
|
+
|
|
233
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
|
|
234
|
+
|
|
235
|
+
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
|
|
236
|
+
|
|
237
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED.
|
|
238
|
+
|
|
239
|
+
---
|
|
240
|
+
|
|
241
|
+
© VampSecure Studios — VampSecure Labs Security Research Division
|
|
@@ -0,0 +1,220 @@
|
|
|
1
|
+
# vamp-azure-audit
|
|
2
|
+
|
|
3
|
+
**Microsoft Azure Security Auditor — VampSecure Labs Security Research Division**
|
|
4
|
+
|
|
5
|
+
Herramienta CLI de auditoría de seguridad para entornos Microsoft Azure. Detecta misconfiguraciones críticas en IAM, Storage Accounts, AKS, App Services, Network Security Groups, Key Vault y Microsoft Defender for Cloud utilizando exclusivamente la REST API oficial de Azure (sin SDKs pesados).
|
|
6
|
+
|
|
7
|
+
> **USO EXCLUSIVO EN ENTORNOS CON AUTORIZACIÓN EXPRESA.**
|
|
8
|
+
> Esta herramienta está diseñada para evaluaciones de seguridad autorizadas. Su uso en entornos sin autorización puede ser ilegal.
|
|
9
|
+
|
|
10
|
+
---
|
|
11
|
+
|
|
12
|
+
## Instalación
|
|
13
|
+
|
|
14
|
+
```bash
|
|
15
|
+
pip install vamp-azure-audit
|
|
16
|
+
```
|
|
17
|
+
|
|
18
|
+
O desde el repositorio:
|
|
19
|
+
|
|
20
|
+
```bash
|
|
21
|
+
git clone https://github.com/Vampsecure-Labs/vamp-azure-audit
|
|
22
|
+
cd vamp-azure-audit
|
|
23
|
+
pip install -e .
|
|
24
|
+
```
|
|
25
|
+
|
|
26
|
+
**Dependencias:** `aiohttp>=3.9.0`, `rich>=13.7.0`, Python 3.9+
|
|
27
|
+
|
|
28
|
+
---
|
|
29
|
+
|
|
30
|
+
## Configuración
|
|
31
|
+
|
|
32
|
+
El Service Principal necesita los siguientes permisos:
|
|
33
|
+
|
|
34
|
+
- **Management API:** rol `Reader` en la suscripción + `Microsoft.Security/pricings/read`
|
|
35
|
+
- **Microsoft Graph:** `User.Read.All` (para detección de usuarios Guest con privilegios)
|
|
36
|
+
|
|
37
|
+
Crear Service Principal con rol Reader:
|
|
38
|
+
|
|
39
|
+
```bash
|
|
40
|
+
az ad sp create-for-rbac --name "vamp-azure-audit" --role "Reader" \
|
|
41
|
+
--scopes /subscriptions/<SUBSCRIPTION_ID>
|
|
42
|
+
```
|
|
43
|
+
|
|
44
|
+
---
|
|
45
|
+
|
|
46
|
+
## Variables de entorno
|
|
47
|
+
|
|
48
|
+
| Variable | Descripción |
|
|
49
|
+
|-------------------------|--------------------------------------------------|
|
|
50
|
+
| `AZURE_SUBSCRIPTION_ID` | ID de la suscripción Azure a auditar |
|
|
51
|
+
| `AZURE_TENANT_ID` | ID del tenant de Azure (Directory ID) |
|
|
52
|
+
| `AZURE_CLIENT_ID` | Application (client) ID del Service Principal |
|
|
53
|
+
| `AZURE_CLIENT_SECRET` | Secreto del Service Principal |
|
|
54
|
+
|
|
55
|
+
---
|
|
56
|
+
|
|
57
|
+
## Uso
|
|
58
|
+
|
|
59
|
+
### Auditoría completa (todos los módulos)
|
|
60
|
+
|
|
61
|
+
```bash
|
|
62
|
+
export AZURE_SUBSCRIPTION_ID="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
|
|
63
|
+
export AZURE_TENANT_ID="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
|
|
64
|
+
export AZURE_CLIENT_ID="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
|
|
65
|
+
export AZURE_CLIENT_SECRET="tu-secreto"
|
|
66
|
+
|
|
67
|
+
vamp-azure-audit
|
|
68
|
+
```
|
|
69
|
+
|
|
70
|
+
### Con flags explícitos
|
|
71
|
+
|
|
72
|
+
```bash
|
|
73
|
+
vamp-azure-audit \
|
|
74
|
+
--subscription-id "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" \
|
|
75
|
+
--tenant-id "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" \
|
|
76
|
+
--client-id "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" \
|
|
77
|
+
--client-secret "tu-secreto"
|
|
78
|
+
```
|
|
79
|
+
|
|
80
|
+
### Módulos específicos
|
|
81
|
+
|
|
82
|
+
```bash
|
|
83
|
+
# Solo IAM y NSG
|
|
84
|
+
vamp-azure-audit --modulos iam nsg
|
|
85
|
+
|
|
86
|
+
# Solo Storage y Key Vault
|
|
87
|
+
vamp-azure-audit --modulos storage keyvault
|
|
88
|
+
|
|
89
|
+
# Solo Defender for Cloud
|
|
90
|
+
vamp-azure-audit --modulos defender
|
|
91
|
+
```
|
|
92
|
+
|
|
93
|
+
### Exportar informes
|
|
94
|
+
|
|
95
|
+
```bash
|
|
96
|
+
# Generar informe HTML
|
|
97
|
+
vamp-azure-audit --output-html informe-azure.html
|
|
98
|
+
|
|
99
|
+
# Generar JSON para integración con otras herramientas
|
|
100
|
+
vamp-azure-audit --output-json hallazgos.json
|
|
101
|
+
|
|
102
|
+
# HTML + JSON en el mismo pase
|
|
103
|
+
vamp-azure-audit --output-html informe.html --output-json hallazgos.json
|
|
104
|
+
```
|
|
105
|
+
|
|
106
|
+
---
|
|
107
|
+
|
|
108
|
+
## Módulos disponibles
|
|
109
|
+
|
|
110
|
+
| Módulo | Flag | Descripción |
|
|
111
|
+
|---------------|----------------|-------------------------------------------------------------------|
|
|
112
|
+
| IAM | `iam` | Roles privilegiados a nivel de suscripción, usuarios Guest |
|
|
113
|
+
| Storage | `storage` | Acceso público a blobs, HTTP, TLS, restricciones de red |
|
|
114
|
+
| AKS | `aks` | RBAC, API server público, NetworkPolicy, versiones desactualizadas|
|
|
115
|
+
| App Services | `appservices` | HTTPS, remote debugging, TLS, FTP sin cifrar |
|
|
116
|
+
| NSG | `nsg` | Puertos críticos expuestos a Internet, reglas abiertas |
|
|
117
|
+
| Key Vault | `keyvault` | Soft Delete, Purge Protection, acceso de red |
|
|
118
|
+
| Defender | `defender` | Planes de Defender for Cloud, contacto de seguridad |
|
|
119
|
+
|
|
120
|
+
---
|
|
121
|
+
|
|
122
|
+
## Hallazgos detectados
|
|
123
|
+
|
|
124
|
+
| ID | Severidad | Descripción |
|
|
125
|
+
|----------------|-----------|------------------------------------------------------------|
|
|
126
|
+
| AZURE-IAM-001 | CRITICAL | Usuario con Owner/Contributor a nivel de suscripción |
|
|
127
|
+
| AZURE-IAM-002 | HIGH | Service Principal con Owner a nivel de suscripción |
|
|
128
|
+
| AZURE-IAM-003 | HIGH | Usuario Guest con roles privilegiados |
|
|
129
|
+
| AZURE-STOR-001 | HIGH | Acceso público a blobs habilitado |
|
|
130
|
+
| AZURE-STOR-002 | HIGH | Tráfico HTTP (sin cifrar) permitido |
|
|
131
|
+
| AZURE-STOR-003 | MEDIUM | Sin restricciones de red en Storage Account |
|
|
132
|
+
| AZURE-STOR-004 | MEDIUM | TLS mínimo inferior a 1.2 |
|
|
133
|
+
| AZURE-AKS-001 | CRITICAL | RBAC desactivado en clúster AKS |
|
|
134
|
+
| AZURE-AKS-002 | HIGH | API server de AKS accesible públicamente |
|
|
135
|
+
| AZURE-AKS-003 | HIGH | Sin NetworkPolicy configurada |
|
|
136
|
+
| AZURE-AKS-004 | MEDIUM | Versión de Kubernetes desactualizada |
|
|
137
|
+
| AZURE-APP-001 | HIGH | App Service no fuerza HTTPS |
|
|
138
|
+
| AZURE-APP-002 | HIGH | Remote debugging habilitado |
|
|
139
|
+
| AZURE-APP-003 | MEDIUM | TLS mínimo inferior a 1.2 en App Service |
|
|
140
|
+
| AZURE-APP-004 | MEDIUM | FTP sin cifrar habilitado |
|
|
141
|
+
| AZURE-NSG-001 | CRITICAL | Puerto crítico expuesto a Internet (0.0.0.0/0) |
|
|
142
|
+
| AZURE-NSG-002 | CRITICAL | Regla NSG permite todo el tráfico entrante |
|
|
143
|
+
| AZURE-KV-001 | HIGH | Soft Delete no habilitado en Key Vault |
|
|
144
|
+
| AZURE-KV-002 | MEDIUM | Purge Protection no habilitado |
|
|
145
|
+
| AZURE-KV-003 | HIGH | Key Vault accesible desde cualquier red |
|
|
146
|
+
| AZURE-KV-004 | HIGH | Acceso público habilitado sin restricciones |
|
|
147
|
+
| AZURE-DEF-001 | HIGH | Microsoft Defender no activo para un servicio |
|
|
148
|
+
| AZURE-DEF-002 | MEDIUM | Sin contacto de seguridad configurado |
|
|
149
|
+
|
|
150
|
+
---
|
|
151
|
+
|
|
152
|
+
## Ejemplo de salida
|
|
153
|
+
|
|
154
|
+
```
|
|
155
|
+
██╗ ██╗ █████╗ ███╗ ███╗██████╗
|
|
156
|
+
██║ ██║██╔══██╗████╗ ████║██╔══██╗
|
|
157
|
+
██║ ██║███████║██╔████╔██║██████╔╝
|
|
158
|
+
╚██╗ ██╔╝██╔══██║██║╚██╔╝██║██╔═══╝
|
|
159
|
+
╚████╔╝ ██║ ██║██║ ╚═╝ ██║██║
|
|
160
|
+
╚═══╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚═╝
|
|
161
|
+
|
|
162
|
+
vamp-azure-audit v1.0 — Azure Security Auditor
|
|
163
|
+
VampSecure Labs Security Research Division
|
|
164
|
+
|
|
165
|
+
→ Autenticando en Azure...
|
|
166
|
+
✓ Token Management API obtenido
|
|
167
|
+
✓ Token Microsoft Graph obtenido
|
|
168
|
+
|
|
169
|
+
→ Auditando IAM / Roles...
|
|
170
|
+
⚠ 2 hallazgo(s) (1 CRITICAL) (1 HIGH)
|
|
171
|
+
→ Auditando Storage Accounts...
|
|
172
|
+
⚠ 3 hallazgo(s) (2 HIGH)
|
|
173
|
+
→ Auditando Network Security Groups...
|
|
174
|
+
⚠ 1 hallazgo(s) (1 CRITICAL)
|
|
175
|
+
...
|
|
176
|
+
|
|
177
|
+
╭─ Resumen de Auditoría ──────────────────────╮
|
|
178
|
+
│ Calificación global: D │
|
|
179
|
+
│ │
|
|
180
|
+
│ 🔴 Critical: 2 🟠 High: 5 🟡 Medium: 4│
|
|
181
|
+
│ │
|
|
182
|
+
│ Total hallazgos: 11 Duración: 8.3s │
|
|
183
|
+
╰─────────────────────────────────────────────╯
|
|
184
|
+
```
|
|
185
|
+
|
|
186
|
+
---
|
|
187
|
+
|
|
188
|
+
## Códigos de salida
|
|
189
|
+
|
|
190
|
+
| Código | Significado |
|
|
191
|
+
|--------|--------------------------------------------------|
|
|
192
|
+
| `0` | Sin hallazgos CRITICAL ni HIGH |
|
|
193
|
+
| `1` | Hallazgos HIGH detectados (sin CRITICAL) |
|
|
194
|
+
| `2` | Hallazgos CRITICAL detectados |
|
|
195
|
+
|
|
196
|
+
Útil para integración en pipelines CI/CD:
|
|
197
|
+
|
|
198
|
+
```bash
|
|
199
|
+
vamp-azure-audit --output-json hallazgos.json
|
|
200
|
+
if [ $? -eq 2 ]; then
|
|
201
|
+
echo "BLOQUEADO: Hallazgos críticos en Azure"
|
|
202
|
+
exit 1
|
|
203
|
+
fi
|
|
204
|
+
```
|
|
205
|
+
|
|
206
|
+
---
|
|
207
|
+
|
|
208
|
+
## Licencia
|
|
209
|
+
|
|
210
|
+
MIT License — Copyright © VampSecure Studios — VampSecure Labs Security Research Division
|
|
211
|
+
|
|
212
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
|
|
213
|
+
|
|
214
|
+
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
|
|
215
|
+
|
|
216
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED.
|
|
217
|
+
|
|
218
|
+
---
|
|
219
|
+
|
|
220
|
+
© VampSecure Studios — VampSecure Labs Security Research Division
|
|
@@ -0,0 +1,36 @@
|
|
|
1
|
+
[build-system]
|
|
2
|
+
requires = ["setuptools>=68", "wheel"]
|
|
3
|
+
build-backend = "setuptools.build_meta"
|
|
4
|
+
|
|
5
|
+
[project]
|
|
6
|
+
name = "vamp-azure-audit"
|
|
7
|
+
version = "1.0"
|
|
8
|
+
description = "Microsoft Azure security auditor for authorized assessments"
|
|
9
|
+
readme = "README.md"
|
|
10
|
+
license = { text = "MIT" }
|
|
11
|
+
requires-python = ">=3.9"
|
|
12
|
+
authors = [{ name = "VampSecure Studios", email = "contact@vampsecurestudios.com" }]
|
|
13
|
+
keywords = ["security", "pentest", "audit", "cybersecurity", "vampsecure", "azure", "cloud", "iam", "microsoft"]
|
|
14
|
+
classifiers = [
|
|
15
|
+
"Development Status :: 5 - Production/Stable",
|
|
16
|
+
"Environment :: Console",
|
|
17
|
+
"Intended Audience :: Information Technology",
|
|
18
|
+
"License :: OSI Approved :: MIT License",
|
|
19
|
+
"Operating System :: OS Independent",
|
|
20
|
+
"Programming Language :: Python :: 3",
|
|
21
|
+
"Topic :: Security",
|
|
22
|
+
]
|
|
23
|
+
dependencies = [
|
|
24
|
+
"aiohttp>=3.9.0",
|
|
25
|
+
"rich>=13.7.0",
|
|
26
|
+
]
|
|
27
|
+
|
|
28
|
+
[project.scripts]
|
|
29
|
+
vamp-azure-audit = "vamp_azure_audit:main"
|
|
30
|
+
|
|
31
|
+
[project.urls]
|
|
32
|
+
Homepage = "https://github.com/Vampsecure-Labs/vamp-azure-audit"
|
|
33
|
+
Repository = "https://github.com/Vampsecure-Labs/vamp-azure-audit"
|
|
34
|
+
|
|
35
|
+
[tool.setuptools]
|
|
36
|
+
py-modules = ["vamp_azure_audit"]
|