Abstract

Vajra (Your Weapon to Cloud) is a framework capable of validating the cloud security posture of the target environment. In Indian mythology, the word Vajra refers to the Weapon of God Indra (God of Thunder and Storms). Because it is cloud-connected, it is an ideal name for the tool. Vajra supports multi-cloud environments and a variety of attack and enumeration strategies for both AWS and Azure. It features an intuitive web-based user interface built with the Python Flask module for a better user experience. The primary focus of this tool is to have different attacking and enumerating techniques all in one place with web UI interfaces so that it can be accessed anywhere by just hosting it on your server.

The following modules are currently available:

• Azure

• Attacking

1. OAuth Based Phishing (Illicit Consent Grant Attack)

• Exfiltrate Data
• Enumerate Environment
• Deploy Backdoors
• Send mails/Create Rules

2. Password Spray
3. Password Brute Force

• Enumeration

1. Users
2. Subdomain
3. Azure Ad
4. Azure Services

• Specific Service

1. Storage Accounts • AWS

• Enumeration

1. IAM Enumeration
2. S3 Scanner

• Misconfiguration