AWS IAM & Organization Audit

Get account aliase Get Account Summary Password Policy Check Generate IAM Credential Report Analyse IAM Credential Report List Users List groups List Roles List Policies Generate Service Last Accessed Details Get Service Last Accessed Details Post to Slack

Aggregating Sub-domain Certificate Information

Get Subdomain Certificates

Get Certificates for Subdomains

Visualize as Table Push to Slack

Check for Common API Vulnerabilities

CORS Misconfiguration

Trusted Unauthorised Subdomain Test

Security Headers

Check for Security Headers

Check response with other users access token

Directory Traversal

Check vulnerability for sequences stripped with superfluous URL-decode

SQL injection Test 1 SQL injection Test 2

Domain Expiry Monitor

Fetch hosted zones fetch paginated hosted zones check domain validity Post to slack - Success

Emails Exposed in Data Breach

Get employees Check employee email Success

Environment Scanner

Scan leaked key Access the contents of workspaces accessible to you Access contents of a specific environment

Find Fake Chrome Apps Using Postman

Chrome web-store XHRequest

Get Web Store Extensions Alert on Slack

Open Redirect Checks

Get URLs Check URL

Retrieve secret from AWS Secrets Manager

GetSecretValue Get Variable

Slack Secret Scanner

Get Channels Scan Messages Join Channel Send Report

TLS Version Monitor

Fetch Hosted Zones Fetch Paginated Hosted Zones Fetch Resource Records Fetch Paginated Resource Records Check TLS Version Push to Slack

The Good Bank APIs

Bank User-Authentication

Update User Information Get User Information User Change Password User Logout

Create User User Login

Account summary Account transactions

Our customers Credit amount Debit amount

Working with AWS Secrets Manager Vault

List MFA Credentials Get STS Token

Working with HashiCorp Vault

Configure Environment

AWS IAM & Organization Audit

Get account aliase Get Account Summary Password Policy Check Generate IAM Credential Report Analyse IAM Credential Report List Users List groups List Roles List Policies Generate Service Last Accessed Details Get Service Last Accessed Details Post to Slack

Aggregating Sub-domain Certificate Information

Get Subdomain Certificates

Get Certificates for Subdomains

Visualize as Table Push to Slack

Check for Common API Vulnerabilities

CORS Misconfiguration

Trusted Unauthorised Subdomain Test

Security Headers

Check for Security Headers

Check response with other users access token

Directory Traversal

Check vulnerability for sequences stripped with superfluous URL-decode

SQL injection Test 1 SQL injection Test 2

Domain Expiry Monitor

Fetch hosted zones fetch paginated hosted zones check domain validity Post to slack - Success

Emails Exposed in Data Breach

Get employees Check employee email Success

Environment Scanner

Scan leaked key Access the contents of workspaces accessible to you Access contents of a specific environment

Find Fake Chrome Apps Using Postman

Chrome web-store XHRequest

Get Web Store Extensions Alert on Slack

Open Redirect Checks

Get URLs Check URL

Retrieve secret from AWS Secrets Manager

GetSecretValue Get Variable

Slack Secret Scanner

Get Channels Scan Messages Join Channel Send Report

TLS Version Monitor

Fetch Hosted Zones Fetch Paginated Hosted Zones Fetch Resource Records Fetch Paginated Resource Records Check TLS Version Push to Slack

The Good Bank APIs

Bank User-Authentication

Update User Information Get User Information User Change Password User Logout

Create User User Login

Account summary Account transactions

Our customers Credit amount Debit amount

Working with AWS Secrets Manager Vault

List MFA Credentials Get STS Token

Working with HashiCorp Vault

Configure Environment

HomeWorking with AWS Secrets Manager Vault

Working with AWS Secrets Manager Vault

Number of APIs: 2

List MFA Credentials GET https://iam.amazonaws.com/?Action=ListMFADevices&Version=2010-05-08
Get STS Token GET https://sts.amazonaws.com/?Version=2011-06-15&Action=GetSessionToken&DurationSeconds=3600&SerialNumber={{SERIAL_NUMBER}}&TokenCode={{MFA_TOKEN_CODE}}

List MFA Credentials