Skip to content

@RhinoSecurityLabs Rhino Security Labs

Change the repository type filter

All

    Repositories list

    20 repositories

    • cloudgoat

      Public
      CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool
      Python
      •
      BSD 3-Clause "New" or "Revised" License
      •751•3.5k•17•4•Updated Apr 21, 2026Apr 21, 2026

    • pacu

      Public
      The AWS exploitation framework, designed for testing the security of Amazon Web Services environments.
      pythonawssecurity
      pythonawssecuritypenetration-testingaws-security
      Python
      •
      BSD 3-Clause "New" or "Revised" License
      •782•5.1k•21•11•Updated Mar 30, 2026Mar 30, 2026

    • IPRotate_Burp_Extension

      Public
      Extension for Burp Suite which uses AWS API Gateway to rotate your IP on every request.
      hackingaws-apigatewaywebapp
      hackingaws-apigatewaywebapppenetration-testingburpsuite
      Python
      •150•891•2•0•Updated Feb 23, 2026Feb 23, 2026

    • IAMActionHunter

      Public
      An AWS IAM policy statement parser and query tool.
      Python
      •
      Apache License 2.0
      •17•199•1•0•Updated Feb 10, 2026Feb 10, 2026

    • GCP-IAM-Privilege-Escalation

      Public
      A collection of GCP IAM privilege escalation methods documented by the Rhino Security Labs team.
      Python
      •
      BSD 3-Clause "New" or "Revised" License
      •78•420•5•3•Updated Oct 6, 2025Oct 6, 2025

    • CVEs

      Public
      Proof-of-Concept exploits for CVEs found by the team at Rhino Security Labs
      Python
      •
      BSD 3-Clause "New" or "Revised" License
      •249•894•0•1•Updated Jun 4, 2025Jun 4, 2025

    • dsnap

      Public
      Utility for downloading and mounting EBS snapshots using the EBS Direct API's
      Python
      •
      BSD 3-Clause "New" or "Revised" License
      •9•93•6•2•Updated Mar 17, 2025Mar 17, 2025

    • GCPBucketBrute

      Public
      A script to enumerate Google Storage buckets, determine what access you have to them, and determine if they can be privilege escalated.
      Python
      •
      BSD 3-Clause "New" or "Revised" License
      •90•560•4•3•Updated May 26, 2023May 26, 2023

    • Swagger-EZ

      Public
      A tool geared towards pentesting APIs using OpenAPI definitions.
      JavaScript
      •
      BSD 3-Clause "New" or "Revised" License
      •45•188•1•0•Updated Oct 27, 2022Oct 27, 2022

    • CloudScraper

      Public
      CloudScraper: Tool to enumerate targets in search of cloud resources. S3 Buckets, Azure Blobs, Digital Ocean Storage Space.
      Python
      •
      MIT License
      •114•34•0•1•Updated Mar 7, 2022Mar 7, 2022

    • little-stitch

      Public
      Send and receive bypassing Little Snitch alerting.
      Go
      •2•13•0•0•Updated Jan 27, 2022Jan 27, 2022

    • amazon-ssm-agent

      Public
      Fork of amazon-ssm-agent that can run as any user in parallel with the official service.
      Go
      •
      Apache License 2.0
      •350•4•0•0•Updated Dec 3, 2021Dec 3, 2021

    • Security-Research

      Public
      Exploits written by the Rhino Security Labs team
      Python
      •
      BSD 3-Clause "New" or "Revised" License
      •296•1.1k•9•3•Updated Jan 23, 2021Jan 23, 2021

    • Cloud-Security-Research

      Public
      Cloud-related research releases from the Rhino Security Labs team.
      Python
      •
      BSD 3-Clause "New" or "Revised" License
      •68•392•0•0•Updated Apr 23, 2020Apr 23, 2020

    • ccat

      Public
      Cloud Container Attack Tool (CCAT) is a tool for testing security of container environments.
      dockerkubernetesaws
      dockerkubernetesawsgooglecloudamazongcprhinocybersecuritygke
      Python
      •
      BSD 3-Clause "New" or "Revised" License
      •110•649•2•0•Updated Nov 21, 2019Nov 21, 2019

    • SleuthQL

      Public
      Python3 Burp History parsing tool to discover potential SQL injection points. To be used in tandem with SQLmap.
      Python
      •
      BSD 3-Clause Clear License
      •83•471•5•1•Updated Nov 14, 2019Nov 14, 2019

    • AWS-IAM-Privilege-Escalation

      Public
      A centralized source of all AWS IAM privilege escalation methods released by Rhino Security Labs.
      BSD 3-Clause "New" or "Revised" License
      •123•927•1•0•Updated Jul 25, 2019Jul 25, 2019

    • Presentations

      Public
      A collection of slides, videos, and proof-of-concept scripts from various Rhino presentations.
      BSD 3-Clause "New" or "Revised" License
      •6•37•0•0•Updated Aug 13, 2018Aug 13, 2018

    • Aggressor-Scripts

      Public
      Aggregation of Cobalt Strike's aggressor scripts.
      PowerShell
      •41•141•1•0•Updated Mar 31, 2018Mar 31, 2018

    • external_c2_framework

      Public
      Python api for usage with cobalt strike's External C2 specification
      Python
      •98•72•0•0•Updated Feb 15, 2018Feb 15, 2018
    ProTip! When viewing an organization's repositories, you can use the props. filter to filter by custom property.