Urgent.News

What's breaking now, across thousands of outlets.

More in Tech

Two AWS IAM privesc tools, one path finder

Four things that surprised me while grading PMapper and cloudfox against a deliberately broken AWS account. Over two weekends I deployed Bishop Fox's iam-vulnerable into a throwaway AWS account and…

  • PMapper crashed during grading due to unhandled errors in region search
  • cloudfox successfully completed grading with 94 principals and 44 trust edges
  • PMapper's grading answer key missed six potential privilege escalation mechanisms

More from Tuesday 1 September →