IaC Attack Surface

Hunt through infrastructure-as-code as an authorized offensive security assessment. The goal is to find misconfigurations that create concrete attacker opportunities: initial access, credential exposure, privilege escalation, lateral movement, workload escape, persistence, data exposure, or detection bypass.

This is a misconfiguration review workflow, not an exploitation workflow. Do not execute attacks or change infrastructure unless the user explicitly asks for follow-up implementation.

Input Contract

Accept natural language or:

$iac-attack-surface [scope] [path]