https://cybertoolchain.io/tools/cloudfox New releases and features in CloudFox, tracked by The Cyber Toolchain. en Wed, 17 Dec 2025 18:38:02 GMT https://github.com/BishopFox/cloudfox/releases/tag/v1.17.0 https://github.com/BishopFox/cloudfox/releases/tag/v1.17.0 Wed, 17 Dec 2025 18:38:02 GMT CloudFox v1.17.0 adds Route53 Alias record support, KMS to resource-trusts, OpenSearch policies, Linux Arm64 builds, and unified logrus logging. • Adds Route53 Alias record support to the `route53` command. • Adds container name column to the `ecs-tasks` command output. • Adds KMS service support to the `resource-trusts` command. • Adds OpenSearch resource-trust policy enumeration to the `resource-trusts` command. • Adds Linux Arm64 build support. • Adds checksums to release packages. • Adds split-level logging via logrus, with all successful API calls logged to `cloudfox-info.log`. Breaking changes: • Versions prior to v1.17.0 depend on a JSON file from AWS that changed its format and no longer work; upgrading to v1.17.0 is required for continued operation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloudfox https://github.com/BishopFox/cloudfox/releases/tag/v1.14.1 https://github.com/BishopFox/cloudfox/releases/tag/v1.14.1 Thu, 04 Jul 2024 03:00:30 GMT CloudFox v1.14.1 adds RDS database instances to output and includes 386 Linux binaries. • Adds RDS database instances back into CloudFox output alongside clusters • Includes 386 Linux binary in release artifacts Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloudfox https://github.com/BishopFox/cloudfox/releases/tag/v1.14.0 https://github.com/BishopFox/cloudfox/releases/tag/v1.14.0 Tue, 16 Apr 2024 19:01:17 GMT CloudFox v1.14.0 adds `cape` subcommand for privilege escalation path visualization and AWS Directory Service support • Adds the `cape` command to visualize potential privilege escalation paths within an environment, including hop count logic and admin highlighting. • Adds native `directoryservices` detection for AWS, extending enumeration capabilities to AWS Managed Microsoft AD and Simple AD deployments. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloudfox https://github.com/BishopFox/cloudfox/releases/tag/v1.13.1 https://github.com/BishopFox/cloudfox/releases/tag/v1.13.1 Fri, 26 Jan 2024 01:43:54 GMT CloudFox v1.13.1 adds `api-gw` command for enumerating API Gateways and updates role-trust data • Adds the `api-gw` subcommand to enumerate AWS API Gateway resources • Enriches the `role-trust` module with data from fwd:cloudsec's known_aws_accounts repo Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloudfox https://github.com/BishopFox/cloudfox/releases/tag/v1.13.0 https://github.com/BishopFox/cloudfox/releases/tag/v1.13.0 Tue, 26 Dec 2023 18:28:52 GMT CloudFox v1.13.0 adds `workloads` and `api-gws` commands, MFA support, and column filtering. • `workloads` command summarizes compute workloads with admin access • `api-gws` command enumerates API gateways and generates a loot file of curl commands • Added `-o wide` flag to all commands for extra columns or ARNs • Users can specify which columns are displayed via the new column filtering feature • Added support for roles that require MFA • `env-vars` now highlights interesting credentials (secret, key, password, token) in output files and colored screen prints Breaking changes: • Default AWS output format changed to v2 (table data). Use `-v1` to revert to the previous list format. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloudfox https://github.com/BishopFox/cloudfox/releases/tag/v1.12.3 https://github.com/BishopFox/cloudfox/releases/tag/v1.12.3 Tue, 19 Dec 2023 21:38:46 GMT Adds --mfa-token CLI flag and universal --cols/-o wide support for table output in CloudFox v1.12.3 • Adds the `--mfa-token` CLI flag to pass MFA tokens at runtime instead of prompting interactively • Adds `--cols` and `-o wide` arguments to all AWS commands for custom column display and ARN visibility Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloudfox https://github.com/BishopFox/cloudfox/releases/tag/v1.12.0 https://github.com/BishopFox/cloudfox/releases/tag/v1.12.0 Tue, 15 Aug 2023 18:45:27 GMT CloudFox v1.12.0 adds `-t` and `-s` common name support in Azure, renames `instances` to `vms`, and enables user-data extraction • The `-t` flag now accepts common names for the Azure tenant ID in addition to the ID itself. • The `-s` flag now accepts common names for the Azure subscription ID in addition to the ID itself. • Renamed the `instances` command to `vms` command to align with Azure terminology. • Added user-data extraction capability to the `vms` command. Breaking changes: • The `instances` subcommand has been renamed to `vms`; existing scripts calling `cloudfox azure instances` will fail. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloudfox https://github.com/BishopFox/cloudfox/releases/tag/v1.11.0 https://github.com/BishopFox/cloudfox/releases/tag/v1.11.0 Fri, 09 Jun 2023 15:08:01 GMT CloudFox v1.11.0 adds resource-trusts, org, codebuild, and databases commands with caching support • Adds the `resource-trusts` command to detect interesting resource policies in CodeBuild, ECR, EFS, Lambda, S3, SNS, and SQS. • Adds the `org` command to check organizational membership, identify the mgmt account, and list all accounts when run on the management account. • Adds the `codebuild` command to list CodeBuild projects. • Adds the `databases` command to enumerate RDS, DynamoDB, RedShift, and DocsDB instances. • Adds function caching to reduce AWS API calls, controlled by the `--ignore-cache` flag. • Changes the default output directory to `~/.cloudfox/cloudfox-output`. Breaking changes: • The default output directory has changed from the current working directory to `~/.cloudfox/cloudfox-output`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloudfox https://github.com/BishopFox/cloudfox/releases/tag/v1.10.0 https://github.com/BishopFox/cloudfox/releases/tag/v1.10.0 Tue, 28 Feb 2023 17:21:13 GMT CloudFox v1.10.0 adds `network-ports`, `sns`, `sqs`, and Azure inventory commands • Adds `network-ports` command to enumerate potentially exposed network services via security groups and NACLs • Adds `sns` command to enumerate SNS topics, summarize resource policies, and provide subscribe/send commands • Adds `sqs` command to enumerate SQS queues, summarize resource policies, and provide receive/send commands • Adds `inventory` command for Azure to enumerate all subscription-level resources • Enables `storage` command on Azure to include public blob URL enumeration • Updates AWS `inventory` command output to generate a loot file listing ARNs of every identified resource Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloudfox https://github.com/BishopFox/cloudfox/releases/tag/v1.9.0 https://github.com/BishopFox/cloudfox/releases/tag/v1.9.0 Wed, 11 Jan 2023 02:52:42 GMT CloudFox v1.9.0 adds aws subcommands ecs-tasks, elastic-network-interfaces, eks, pmapper; new azure commands whoami and storage; rbac support. • Adds `ecs-tasks` AWS command to list ECS tasks with associated cluster, task definition, container instance, launch type, and IAM principal. • Adds `elastic-network-interfaces` AWS command to list ENI information including ID, type, external/private IPs, VPCID, attached instance, and description. • Adds `eks` AWS command to list EKS clusters, check public endpoint exposure, verify associated IAM roles for cluster/node groups, and generate loot files with `aws eks update-kubeconfig` commands. • Adds `pmapper` AWS command to detect local pmapper data, build an in-memory graph, and identify privilege escalation paths to admin. • Enhances Role Insights: `instances`, `lambda`, `eks`, `ecs-tasks`, and `role-trusts` commands now utilize pmapper data (or fall back to `iam-simulator`) to report if a workload's role is or can privesc to admin. • Updates `role-trusts` AWS command to display federated role trusts, which were previously missing. • Adds `whoami` Azure command to display current tenant, subscriptions, and resource groups available to the active Azure CLI session. • Adds `storage` Azure command (under development) to display limited data about storage accounts. • Updates Azure `instances` command to enumerate compute instance information at subscription or tenant level. • Adds `rbac` Azure command to map Azure RBAC role assignments at subscription or tenant level. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloudfox https://github.com/BishopFox/cloudfox/releases/tag/v1.8.1 https://github.com/BishopFox/cloudfox/releases/tag/v1.8.1 Wed, 19 Oct 2022 20:31:35 GMT CloudFox v1.8.1 adds `aws lambdas`, `aws cloudformation`, `aws ram`, and `aws tags` commands for new AWS attack surface analysis. • Adds `AWS/lambdas` command to list Lambda functions with admin role attachments • Adds `AWS/cloudformation` command to list CloudFormation stacks, parameters, and outputs in loot files • Adds `AWS/ram` command to list resources shared across AWS accounts for cross-account attack paths • Adds `AWS/tags` command to inventory resources by tag for discovery purposes Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloudfox https://github.com/BishopFox/cloudfox/releases/tag/v1.7.1 https://github.com/BishopFox/cloudfox/releases/tag/v1.7.1 Fri, 23 Sep 2022 18:46:12 GMT CloudFox v1.7.1 adds DynamoDB/Glue/SNS/SQS inventory and `-g` concurrency flag • Adds DynamoDB, Glue, SNS, and SQS resources to the inventory collection output • Adds `-g INT` flag to configure the user-defined concurrency limit for API requests Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cloudfox