Download
Pacu (named after a type of Piranha in the Amazon) is a comprehensive AWS security-testing toolkit designed for offensive security practitioners. While several AWS security scanners currently serve as the proverbial “Nessus” of the cloud, Pacu is designed to be the Metasploit equivalent. Written in Python 3 with a modular architecture, Pacu has tools for every step of the pen testing process, covering the full cyber kill chain. Pacu is the aggregation of all of the exploitation experience and research from our countless prior AWS red team engagements. Automating components of the assessment not only improves efficiency but also allows our assessment team to be much more thorough in large environments. What used to take days to manually enumerate can be now be achieved in minutes. There are currently over 35 modules that range from reconnaissance, persistence, privilege escalation, enumeration, data exfiltration, log manipulation, and miscellaneous general exploitation.
Features
- Pacu is a fairly lightweight program, as it requires only Python3.6+ and pip3 to install a handful of Python libraries
- Pacu uses a range of plug-in modules to assist an attacker in enumeration
- Pacu has 36 modules for executing AWS attacks
- We've designed Pacu from the ground up with extensibility in mind
- A common syntax and data structure keep modules easy to build and expand on
- No need to specify AWS regions or make redundant permission checks between modules
Project Samples
