Forge — pr0t31n

How It Works

⚠️ Authorized Testing Only

This tool interacts with live systems and must only be used for testing that has been explicitly authorized by the asset owner. Unauthorized use of this tool to probe, scan, exploit, or otherwise interact with systems you do not have written permission to test is illegal under computer fraud and abuse laws (CFAA, CMA, and international equivalents). pr0t31n does not condone or recommend any unauthorized use. Always obtain a signed Rules of Engagement (RoE) or Statement of Work (SoW) before beginning any assessment.

Forge is a multi-cloud control-plane security auditor that inspects AWS, Azure, and GCP environments for misconfigurations and security weaknesses. It operates as a CLI tool or under a Crucible-managed Flask orchestrator (when CRUCIBLE_MANAGED=1 is set).

Architecture: Forge follows a modular auditor pattern with three independent cloud-provider audit functions (audit_aws, audit_azure, audit_gcp), each invoking the respective cloud CLI (aws, az, gcloud) and parsing JSON output to detect misconfigurations. All CLI invocations are routed through pr0t31n_tool_runner.run_tool() for automatic .log sibling generation and error detection.

Workflow:

Initialization — Creates a universal run directory (Section 13 structure) with meta.json, scan.log, and errors.log. Writes a dependency snapshot listing cloud CLI versions.
Azure Audit — Enumerates storage accounts (HTTPS enforcement, network ACLs), key vaults (soft-delete, purge protection), and VMs (disk encryption).
GCP Audit — Enumerates GCS buckets (uniform access), compute instances (default service accounts, public IPs), and IAM policies (over-privileged project-level roles).
AWS Audit — The most comprehensive phase, covering S3 buckets (public access blocks, versioning, encryption, access logging), EC2 instances (public IPs), EBS volumes (encryption), security groups (sensitive port exposure to 0.0.0.0/0), IAM users (MFA, AdministratorAccess, access key age, root keys via credential report), RDS instances (public accessibility, encryption, backups), CloudTrail trails (existence and active logging), and KMS keys (rotation status).
Output — Writes findings.json, findings.csv, summary.json, and checkpoint.json in the universal schema v1.1 format.

Pause/Resume: Forge integrates with PauseManager for graceful pause/resume when running under Crucible. Checkpoints are saved at phase boundaries so state can be recovered.

Token Protocol: When managed, Forge emits __CRUCIBLE_LOG__, __CRUCIBLE_ERR__, __CRUCIBLE_STATUS__, and __CRUCIBLE_FINDING__ tokens on stdout for the Crucible manager to parse.

Phase Pipeline

Phase 1 — Cloud Authentication
Phase 2 — Resource Discovery
Phase 3 — Configuration Audit
Phase 4 — IAM Analysis
Phase 5 — Findings Generation

Security

Forge itself performs read-only enumeration against cloud control planes — it does not modify any cloud resources. It relies on pre-configured cloud CLI credentials (AWS profiles, Azure subscriptions, GCP project access) that must already be authenticated before Forge runs.

Findings are written to a run directory with no network exfiltration. Secrets and credentials from cloud responses are not persisted — only configuration state (encryption enabled, public access settings, policy ARNs) is recorded.

Features

AWS Auditing

S3 Bucket Security

Checks public access blocks (all four settings), versioning, default encryption (SSE-S3/SSE-KMS), and server access logging for every bucket.

EC2 Instance Audit

Identifies instances with public IPs and unencrypted EBS volumes.

Security Group Analysis

Detects security groups exposing sensitive ports (22, 3389, 3306, 5432, 1433, 27017, 6379, 9200) to 0.0.0.0/0, and groups allowing all ports unrestricted.

IAM User Audit

Checks MFA enrollment, direct AdministratorAccess attachment, and access key age (flags keys older than 90 days). Parses the credential report to detect root account access keys.

RDS Database Audit

Identifies publicly accessible RDS instances, unencrypted storage, and disabled automated backups.

CloudTrail Audit

Verifies that CloudTrail trails exist and are actively logging. Flags accounts with no trails configured.

KMS Key Rotation

Checks customer-managed KMS keys for automatic key rotation enablement.

Azure Auditing

Storage Account Security

Detects storage accounts that do not enforce HTTPS-only traffic and those with network ACL defaulting to Allow (no IP restrictions).

Key Vault Protection

Checks for disabled soft-delete and purge-protection on Azure Key Vaults.

VM Disk Encryption

Identifies Azure VMs with Azure Disk Encryption (ADE) disabled on the OS disk.

GCP Auditing

GCS Bucket Access

Detects buckets with uniform bucket-level access disabled, exposing them to legacy ACL misconfigurations.

Compute Instance Review

Flags instances using the default Compute Engine service account and those with external IPs configured.

IAM Policy Analysis

Identifies users and service accounts granted project-level roles/owner or roles/editor.

Integration

Crucible-Managed Mode

Emits __CRUCIBLE_LOG/ERR/STATUS/FINDING__ protocol tokens when CRUCIBLE_MANAGED=1 for real-time UI integration.

Pause/Resume Support

Integrates with PauseManager for graceful pause/resume when running under Crucible, with checkpoint callbacks.

Dependency Snapshot

Writes a pr0t31n_dep_snapshot recording versions of aws, az, and gcloud CLIs used during the run.

Output & Reporting

Universal Schema Output

Writes findings in pr0t31n universal schema v1.1 format (findings.json, findings.csv, summary.json, meta.json) for Prometheus ingestion and cross-tool correlation.

Checkpoint & Resume

Saves checkpoint.json at phase boundaries to support resume after interruption.

Use Cases

Pre-Engagement Cloud Assessment

Run Forge against a client's AWS, Azure, or GCP environment before a penetration test to identify low-hanging cloud misconfigurations (public S3 buckets, unencrypted storage, missing MFA) that inform the test scope.

Multi-Cloud Security Posture Review

Audit all three major cloud providers in a single run by passing --azure-subscription, --gcp-project, and --aws-profile together. Produces a unified findings.json covering the entire cloud estate.

AWS IAM Hygiene Check

Specifically target IAM weaknesses: users without MFA, stale access keys (90+ days), direct AdministratorAccess grants, and root account access keys still active.

Compliance Evidence Collection

Generate machine-readable findings (with catalogue IDs like FORGE-AWS-001, FORGE-AZ-001, FORGE-GCP-001) for compliance frameworks that require evidence of cloud configuration reviews.

Crucible-Managed Batch Audit

Deploy Forge under Crucible's orchestration for multi-target cloud audits with real-time status tracking, pause/resume, and centralized findings aggregation.

CLI Reference

Third-Party Tool Invocations

Commands and flags used when this tool invokes third-party dependencies during operation.

az

Azure resource auditing via Azure CLI

az storage account list

az keyvault list

az vm list

gcloud

GCP resource auditing via Google Cloud CLI

gcloud storage buckets list

gcloud compute instances list

gcloud projects get-iam-policy <project-id>

aws

AWS resource auditing via AWS CLI — covers S3, EC2, EBS, Security Groups, IAM, RDS, CloudTrail, KMS

aws s3api list-buckets

aws s3api get-public-access-block --bucket <name>

aws ec2 describe-instances

aws ec2 describe-security-groups

aws iam list-users

aws iam generate-credential-report

aws rds describe-db-instances

aws cloudtrail describe-trails

aws kms list-keys

Finding Nomenclature

Forge uses cloud-provider-prefixed catalogue IDs:

FORGE-AWS-* — AWS findings (S3 public access, unencrypted EBS, root access keys, MFA gaps, open security groups, RDS exposure, CloudTrail gaps, KMS rotation)
FORGE-AZ-* — Azure findings (storage account security, Key Vault configuration, VM exposure)
FORGE-GCP-* — GCP findings (GCS bucket ACLs, compute instance exposure, IAM policy issues)

Output Files

File	Format	Description
`meta.json`	JSON	Tool identity and engagement metadata
`findings.json`	JSON	Universal findings array v1.1
`findings.csv`	CSV	CSV mirror of findings
`summary.json`	JSON	Aggregated statistics
`scan.log`	TXT	Human-readable timestamped log
`scan.log.json`	JSONL	Machine-readable JSON log events
`errors.log`	TXT	ERROR-level entries only
`checkpoint.json`	JSON	Resumable scan checkpoint

Invocation Methods

Method	Usage
CLI — Direct	`cd /opt/pr0t31n/Forge && python3 forge.py [OPTIONS]` Run directly with command-line arguments.
Crucible-Managed	Launched and managed by Crucible (port 5100). Crucible handles start/stop/pause, log streaming, findings aggregation, and status tracking.

Integration

Used By

Crucible (manages)

Third-Party Dependencies & Credits

Tool / Library	Developer	Type	Link
Azure CLI (az)	Microsoft	system	https://github.com/Azure/azure-cli
Google Cloud CLI (gcloud)	Google	system	https://cloud.google.com/sdk/gcloud

Metadata

Name	Forge
Category	Analysis
Version	1.1.2
Install Path	`/opt/pr0t31n/Forge`
Main File	`forge.py`
GitHub	https://github.com/pr0t31n/Forge.git