CloudFox

No entries match these filters. Clear filters

1. v2.0.0 Mar 4, 2026 · release notes

   CloudFox v2.0.0 launches full GCP support with org-wide enumeration, attack-path detection, network diagrams, and new data-store discovery modules.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.0.0 https://github.com/BishopFox/cloudfox.git
   # already have the repo? check out this version:
   $ git checkout v2.0.0

   • Adds GCP cloud provider support across all enumeration modules via a new gcp command surface.
   • New --all-projects flag enables org-wide enumeration across every GCP project in a single run.
   • New whoami enhancements surface privilege-escalation descriptions and identity counts for GCP.
   • New ASCII tree view of GCP organization hierarchy for rapid scope understanding.
   • New log-enum, bigquery-enum, bigtable-enum, and spanner-enum modules to discover sensitive data stored in GCP logging, BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data., Bigtable, and Spanner.

   +7 more show less

   • Adds GCP network diagram generation to visualize VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. topology.
   • Introduces automatic org detection for VPC enumeration.
   • GCP storage command replaces the previous buckets command with unlimited enumeration (no per-project caps).
   • Hierarchical output structure for GCP results with per-project labeling.
   • Disk-based caching (physical cache) for GCP SDK calls, mirroring AWS module behavior.
   • Loot files normalized and additional follow-on commands added to GCP output.
   • Improved output streaming and automatic file splitting for large GCP result sets.

   12 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The buckets subcommand is renamed to storage; any scripts or workflows calling cloudfox gcp buckets must be updated to cloudfox gcp storage.
   • !The attackpath and orgcache flags have been removed and their behavior is now always enabled by default; passing those flags will cause an error.
2. v1.17.0 Dec 17, 2025 · release notes

   CloudFox v1.17.0 adds Route53 Alias record support, KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. to resource-trusts, OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. policies, Linux Arm64 builds, and unified logrus logging.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.17.0 https://github.com/BishopFox/cloudfox.git
   # already have the repo? check out this version:
   $ git checkout v1.17.0

   └──▷ TRY IT
   Enumerate cross-account KMS key trust policies alongside other resource trusts in a single pass.
   copy

   $ cloudfox aws resource-trusts

   List all Route53 records including Alias records (e.g., ELB/CloudFront targets) for subdomain takeover research.
   copy

   $ cloudfox aws route53

   • Adds Route53 Alias record support to the route53 command.
   • Adds container name column to the ecs-tasks command output.
   • Adds KMS service support to the resource-trusts command.
   • Adds OpenSearch resource-trust policy enumeration to the resource-trusts command.
   • Adds Linux Arm64 build support.

   +2 more show less

   • Adds checksums to release packages.
   • Adds split-level logging via logrus, with all successful API calls logged to cloudfox-info.log.

   7 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Versions prior to v1.17.0 depend on a JSON file from AWS that changed its format and no longer work; upgrading to v1.17.0 is required for continued operation.
3. v1.15.0 Oct 17, 2024 · release notes

   CloudFox v1.15.0 adds admin/pmapper logic to principals and a new --admin-check-only flag to iam-simulator.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.15.0 https://github.com/BishopFox/cloudfox.git
   # already have the repo? check out this version:
   $ git checkout v1.15.0

   └──▷ TRY IT
   Run iam-simulator scoped only to admin-level actions to rapidly triage over-privileged roles without a full permission simulation.
   copy

   $ cloudfox aws iam-simulator --admin-check-only

   • Adds admin/pmapper privilege-escalation logic to the principals command for faster identification of administrative principals.
   • New --admin-check-only flag on the iam-simulator command to focus scans exclusively on admin-level permission checks.
   • Updates admin action detection in iam-simulator to check ssm:GetParameters instead of ssm:GetDocument for more accurate admin identification.
   • New flag on cape to ignore specific edges entirely, giving analysts control over graph noise in cross-account trust visualizations.
   • Adds explicit edge generation in cape for cross-account explicit trust relationships.

   5 details in Everything

4. v1.14.1 Jul 4, 2024 · release notes

   CloudFox v1.14.1 adds RDS database instances to output and includes 386 Linux binaries.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.14.1 https://github.com/BishopFox/cloudfox.git
   # already have the repo? check out this version:
   $ git checkout v1.14.1

   • Adds RDS database instances back into CloudFox output alongside clusters
   • Includes 386 Linux binary in release artifacts

   2 details in Everything

5. v1.14.0 Apr 16, 2024 · release notes

   CloudFox v1.14.0 adds cape subcommand for privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. path visualization and AWS Directory Service support

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.14.0 https://github.com/BishopFox/cloudfox.git
   # already have the repo? check out this version:
   $ git checkout v1.14.0

   └──▷ USE IT
   Visualize attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. with specific configuration using the enhanced loot file format.
   shell copy

   cloudfox cape --pmapper-basepath ./loot

   • Adds the cape command to visualize potential privilege escalation paths within an environment, including hop count logic and admin highlighting.
   • Adds native directoryservices detection for AWS, extending enumeration capabilities to AWS Managed Microsoft AD and Simple AD deployments.

   2 details in Everything

6. v1.13.1 Jan 26, 2024 · release notes

   CloudFox v1.13.1 adds api-gw command for enumerating API Gateways and updates role-trust data

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.13.1 https://github.com/BishopFox/cloudfox.git
   # already have the repo? check out this version:
   $ git checkout v1.13.1

   • Adds the api-gw subcommand to enumerate AWS API Gateway resources
   • Enriches the role-trust module with data from fwd:cloudsec's known_aws_accounts repo

   2 details in Everything

7. v1.13.0 Dec 26, 2023 · release notes

   CloudFox v1.13.0 adds workloads and api-gws commands, MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. support, and column filtering.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.13.0 https://github.com/BishopFox/cloudfox.git
   # already have the repo? check out this version:
   $ git checkout v1.13.0

   └──▷ USE IT
   Summarize workloads with admin paths in your AWS account.
   shell copy

   cloudfox aws workloads

   Enumerate API gateways and save curl commands to access endpoints for credential theft.
   shell copy

   cloudfox aws api-gws -o loot.txt

   Use the wide output mode to see ARNs instead of names for better context.
   shell copy

   cloudfox aws inventory -o wide

   • workloads command summarizes compute workloads with admin access
   • api-gws command enumerates API gateways and generates a loot file of curl commands
   • Added -o wide flag to all commands for extra columns or ARNs
   • Users can specify which columns are displayed via the new column filtering feature
   • Added support for roles that require MFA

   +1 more show less

   • env-vars now highlights interesting credentials (secret, key, password, token) in output files and colored screen prints

   6 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Default AWS output format changed to v2 (table data). Use -v1 to revert to the previous list format.
8. v1.12.3 Dec 19, 2023 · release notes

   Adds --mfa-token CLI flag and universal --cols/-o wide support for table output in CloudFox v1.12.3

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.12.3 https://github.com/BishopFox/cloudfox.git
   # already have the repo? check out this version:
   $ git checkout v1.12.3

   • Adds the --mfa-token CLI flag to pass MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. tokens at runtime instead of prompting interactively
   • Adds --cols and -o wide arguments to all AWS commands for custom column display and ARN visibility

   2 details in Everything

9. v1.12.0 Aug 15, 2023 · release notes

   CloudFox v1.12.0 adds -t and -s common name support in Azure, renames instances to vms, and enables user-data extraction

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.12.0 https://github.com/BishopFox/cloudfox.git
   # already have the repo? check out this version:
   $ git checkout v1.12.0

   └──▷ USE IT
   Run the Azure inventory using a friendly tenant name instead of a UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. for the -t flag.
   shell copy

   cloudfox azure -t my-tenant-name -s 01234567-89ab-cdef-0123-456789abcdef

   List Azure VMs using the new vms command name, which is required after this release.
   shell copy

   cloudfox azure vms

   • The -t flag now accepts common names for the Azure tenant ID in addition to the ID itself.
   • The -s flag now accepts common names for the Azure subscription ID in addition to the ID itself.
   • Renamed the instances command to vms command to align with Azure terminology.
   • Added user-data extraction capability to the vms command.

   4 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The instances subcommand has been renamed to vms; existing scripts calling cloudfox azure instances will fail.
10. v1.11.0 Jun 9, 2023 · release notes

    CloudFox v1.11.0 adds resource-trusts, org, codebuild, and databases commands with caching support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.11.0 https://github.com/BishopFox/cloudfox.git
    # already have the repo? check out this version:
    $ git checkout v1.11.0

    └──▷ TRY IT
    Scan for suspicious resource trust relationships across major AWS services.
    copy

    $ cloudfox aws resource-trusts

    Check if the current AWS account is part of an organization and retrieve the management account ID.
    copy

    $ cloudfox aws org

    • Adds the resource-trusts command to detect interesting resource policies in CodeBuild, ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure., EFS, Lambda, S3, SNSSNSAmazon Simple Notification Service, a managed pub/sub messaging service from AWS that lets tools fan out alerts or events to multiple subscribers — queues, email, HTTP endpoints, or Lambda functions — without managing broker infrastructure., and SQS.
    • Adds the org command to check organizational membership, identify the mgmt account, and list all accounts when run on the management account.
    • Adds the codebuild command to list CodeBuild projects.
    • Adds the databases command to enumerate RDS, DynamoDB, RedShift, and DocsDB instances.
    • Adds function caching to reduce AWS API calls, controlled by the --ignore-cache flag.

    +1 more show less

    • Changes the default output directory to ~/.cloudfox/cloudfox-output.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The default output directory has changed from the current working directory to ~/.cloudfox/cloudfox-output.
11. v1.10.0 Feb 28, 2023 · release notes

    CloudFox v1.10.0 adds network-ports, sns, sqs, and Azure inventory commands

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.10.0 https://github.com/BishopFox/cloudfox.git
    # already have the repo? check out this version:
    $ git checkout v1.10.0

    └──▷ USE IT
    Identify exposed ports on AWS resources by parsing security groups and NACLs.
    shell copy

    cloudfox aws network-ports

    List all SNSSNSAmazon Simple Notification Service, a managed pub/sub messaging service from AWS that lets tools fan out alerts or events to multiple subscribers — queues, email, HTTP endpoints, or Lambda functions — without managing broker infrastructure. topics in the current AWS profile and prepare to interact with them.
    shell copy

    cloudfox aws sns

    Enumerate all resources within an Azure subscription using the new inventory module.
    shell copy

    cloudfox azure inventory

    • Adds network-ports command to enumerate potentially exposed network services via security groups and NACLs
    • Adds sns command to enumerate SNS topics, summarize resource policies, and provide subscribe/send commands
    • Adds sqs command to enumerate SQS queues, summarize resource policies, and provide receive/send commands
    • Adds inventory command for Azure to enumerate all subscription-level resources
    • Enables storage command on Azure to include public blob URL enumeration

    +1 more show less

    • Updates AWS inventory command output to generate a loot file listing ARNs of every identified resource

    6 details in Everything

12. v1.9.0 Jan 11, 2023 · release notes

    CloudFox v1.9.0 adds aws subcommands ecs-tasks, elastic-network-interfaces, eks, pmapper; new azure commands whoami and storage; rbac support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.9.0 https://github.com/BishopFox/cloudfox.git
    # already have the repo? check out this version:
    $ git checkout v1.9.0

    • Adds ecs-tasks AWS command to list ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. tasks with associated cluster, task definition, container instance, launch type, and IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. principal.
    • Adds elastic-network-interfaces AWS command to list ENI information including ID, type, external/private IPs, VPCID, attached instance, and description.
    • Adds eks AWS command to list EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. clusters, check public endpoint exposure, verify associated IAM roles for cluster/node groups, and generate loot files with aws eks update-kubeconfig commands.
    • Adds pmapper AWS command to detect local pmapper data, build an in-memory graph, and identify privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. paths to admin.
    • Enhances Role Insights: instances, lambda, eks, ecs-tasks, and role-trusts commands now utilize pmapper data (or fall back to iam-simulator) to report if a workload's role is or can privesc to admin.

    +5 more show less

    • Updates role-trusts AWS command to display federated role trusts, which were previously missing.
    • Adds whoami Azure command to display current tenant, subscriptions, and resource groups available to the active Azure CLI session.
    • Adds storage Azure command (under development) to display limited data about storage accounts.
    • Updates Azure instances command to enumerate compute instance information at subscription or tenant level.
    • Adds rbac Azure command to map Azure RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. role assignments at subscription or tenant level.

    10 details in Everything

13. v1.8.1 Oct 19, 2022 · release notes

    CloudFox v1.8.1 adds aws lambdas, aws cloudformation, aws ram, and aws tags commands for new AWS attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. analysis.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.8.1 https://github.com/BishopFox/cloudfox.git
    # already have the repo? check out this version:
    $ git checkout v1.8.1

    • Adds AWS/lambdas command to list Lambda functions with admin role attachments
    • Adds AWS/cloudformation command to list CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. stacks, parameters, and outputs in loot files
    • Adds AWS/ram command to list resources shared across AWS accounts for cross-account attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately.
    • Adds AWS/tags command to inventory resources by tag for discovery purposes

    4 details in Everything

14. v1.7.1 Sep 23, 2022 · release notes

    CloudFox v1.7.1 adds DynamoDB/Glue/SNSSNSAmazon Simple Notification Service, a managed pub/sub messaging service from AWS that lets tools fan out alerts or events to multiple subscribers — queues, email, HTTP endpoints, or Lambda functions — without managing broker infrastructure./SQS inventory and -g concurrency flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.1 https://github.com/BishopFox/cloudfox.git
    # already have the repo? check out this version:
    $ git checkout v1.7.1

    └──▷ USE IT
    Increase the number of concurrent AWS API calls during inventory gathering to speed up execution.
    shell copy

    cloudfox --aws-profile default -g 50

    • Adds DynamoDB, Glue, SNS, and SQS resources to the inventory collection output
    • Adds -g INT flag to configure the user-defined concurrency limit for API requests

    2 details in Everything

15. v1.7.0 Sep 12, 2022 · release notes

    CloudFox v1.7.0 adds newest output strategy for Azure instances and RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. with phased-out legacy support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.0 https://github.com/BishopFox/cloudfox.git
    # already have the repo? check out this version:
    $ git checkout v1.7.0

    └──▷ TRY IT
    Enumerate Azure VM instances using the new latest strategy instead of the deprecated one
    copy

    $ cloudfox azure --output-strategy az_instance_latest

    Enumerate Azure RBAC assignments using the new latest strategy instead of the deprecated one
    copy

    $ cloudfox azure --output-strategy az_rbac_latest

    • Adds az_instance_latest output strategy for enumerating Azure VM instances
    • Adds az_rbac_latest output strategy for enumerating Azure RBAC assignments

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The old Azure instance output strategy is completely phased out and no longer available
    • !The old Azure RBAC output strategy is completely phased out and no longer available