Home

OCInferno Wiki

OCInferno is a Pacu-style OCI (Oracle Cloud Infrastructure) offensive-security framework for workspace-driven credential handling, service enumeration, artifact download, saved-data configuration auditing, and graph-based attack-path analysis. It covers 79 OCI services (82 enumeration modules) across a compartment-scoped data model, plus a saved-data configuration audit engine (process_config_check, 145 findings across 65 services) and a BloodHound OpenGraph generator (process_oracle_cloud_hound_data). It is the OCI sibling of GCPwn.

Use this page as the canonical index for the wiki.

Getting Started

1. Getting Started
2. Common Use Cases
3. Authentication Reference
4. Workspace Instructions
5. Orchestration Module Reference
6. Enumeration Module Reference
7. Exploit Module Reference
8. Downloads to Disk
9. Data View/Export

OpenGraph Workflows

• OpenGraph - Node/Edge Tables
• OpenGraph - Default Priv Escalation Mode
• OpenGraph - Add Your Own Edges
• OpenGraph - IAM Conditionals
• OpenGraph - Inheritance & IncludeAll

Config Checks

• ConfigChecker - Static Config Checks

Development and Operations

• Module Development Guide
• Troubleshooting and FAQ

Module Layout

Modules live under ocinferno/modules/ in these areas:

• <service>/{enumeration,exploit,utilities}/ — the per-service modules (one directory per OCI service). The enumeration file is a thin CLI wrapper; the real OCI API logic lives in utilities/helpers.py as Resource classes. Categories are Enumeration, Process, and Exploit.
• identityclient/exploit/ — the Exploit modules (offensive write actions: add user API keys, create users, create groups, add self to a group, write policies). See Orchestration Module Reference.
• everything/ — cross-cutting orchestrators: enum_all (cross-service enumeration) and process_config_check (the saved-data configuration audit engine).
• opengraph/ — the OpenGraph / BloodHound generator (process_oracle_cloud_hound_data), which is OCI-specific.

Dotted module paths follow the folder layout, e.g. ocinferno.modules.identityclient.enumeration.enum_identity. The authoritative module list lives in ocinferno/mappings/module_mappings.json; the service-table schema lives in ocinferno/mappings/database_info.json.

Service Coverage

Enumeration modules span OCI IAM and workload services, including:

• Identity & IAM: Identity (IAM users/groups/dynamic groups + Identity Domains), Compartments (enum_comp), Tagging, Vault, Resource Manager, Resource Scheduler.
• Compute & containers: Core Compute (instances/images + instance-agent plugins), Core Block Storage, Core Networking, Kubernetes (OKE), Container Instances, Container Registry, Functions, DevOps, Desktops.
• Data & databases: Databases, Data Flow, Data Science, Managed Kafka, Blockchain, Object Storage, File Storage.
• Networking & edge: DNS, Network Firewall, API Gateway, Notifications, Email Delivery, IoT.
• Security & platform: Cloud Guard, Artifact Registry, Logging.

The full, authoritative list is ocinferno/mappings/module_mappings.json; see Orchestration Module Reference for per-module flags and coverage.

Recommended Baseline Run

# Broad enumeration across all service modules, recursing compartments,
# following LIST with GET for deeper detail, and pulling content where supported.
modules run enum_all --comp --get --download

# Run saved-data configuration audits over the collected data.
modules run process_config_check

# Build the OpenGraph JSON for BloodHound.
modules run process_oracle_cloud_hound_data --expand-inherited --reset --out opengraph_output.json

Export collected data:

data export csv
data export json
data export excel      # requires the optional [excel] extra: pip install "ocinferno[excel]"
data export treeimage  # compartment-hierarchy SVG

Scope and Safety

Use OCInferno only in environments where you have explicit authorization to perform security testing.