{
  "id": 4757387,
  "title": "Two AWS IAM privesc tools, one path finder",
  "url": "https://urgent.news/2026/09/01/two-aws-iam-privesc-tools-one-path-finder",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-01T01:25:24.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/yayopalacios/two-aws-iam-privesc-tools-26pb"
  },
  "original_language": "en",
  "account": "Two open-source IAM privilege-escalation tools, cloudfox 2.0.5 and PMapper 1.1.5, were graded against a deliberately broken AWS account. Both tools were run after deploying Bishop Fox's iam-vulnerable into a throwaway AWS account. The grading was based on a rubric and four findings were noted:\n\n1. PMapper crashed due to an unhandled error when trying to search a region that was either disabled or encountered an authorization issue. This error caused the program to terminate before completing its nine checks, leaving no saved data for further analysis. The issue stems from how PMapper handles region failures during its map-building process. In contrast, cloudfox completed the tool without any issues.\n\n2. cloudfox successfully ran and produced 94 principals, 6,008 permission grants, and 44 trust edges. It created 15 CSV files and their JSON versions. However, cloudfox does not have a path-finding engine of its own; it relies on PMapper to perform this task. PMapper then provides cloudfox with its results.\n\n3. The grading answer key was incorrect for PMapper, as it missed six mechanisms that could escalate privileges. PMapper was inconsistent in reporting these mechanisms, marking them as \"Skipping, no PMapper data\" when they actually could lead to privilege escalation. This inconsistency arose because PMapper only reports permissions that can escalate themselves, whereas the other six mechanisms can't.\n\nIn summary, PMapper had significant issues during its operation, while cloudfox completed the grading process successfully. The tools have different strengths and weaknesses, but cloudfox is the more reliable option due to its consistent performance and lack of recent updates for PMapper.",
  "summary": "Four things that surprised me while grading PMapper and cloudfox against a deliberately broken AWS account. Over two weekends I deployed Bishop Fox's iam-vulnerable into a throwaway AWS account and ran two open-source IAM privilege-escalation tools against it: cloudfox 2.0.5 and PMapper 1.1.5. I graded every scenario by hand against a rubric I froze in git before I deployed anything. I expected a…",
  "key_points": [
    "PMapper crashed during grading due to unhandled errors in region search",
    "cloudfox successfully completed grading with 94 principals and 44 trust edges",
    "PMapper's grading answer key missed six potential privilege escalation mechanisms"
  ],
  "editors_take": "The comparison of cloudfox and PMapper tools reveals that cloudfox is more reliable for AWS IAM privilege escalation due to its consistent performance, while PMapper's inconsistent reporting and error handling hinder its effectiveness.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}