OCInferno: An Offensive Security Toolkit for OCI
Scott Weston
fwd:cloudsec North America 2026 · Day 1
In this fwd:cloudsec presentation, Scott Weston introduces **OCInferno**, a comprehensive offensive security toolkit designed specifically for Oracle Cloud Infrastructure (OCI). The talk delves into the intricacies of OCI's unique Identity and Access Management (IAM) model, highlighting challenges posed by its policy syntax and the often-overlooked concept of identity domains. Weston, known for developing similar tools for AWS and GCP, emphasizes the growing relevance of OCI in the cloud market, making it a critical target for penetration testers and security professionals.
AI review
Weston does the actual work here — OCI offensive tooling is a genuine gap in the community, and OCInferno fills it with enumeration, policy parsing, and BloodHound graph integration that mirrors what Pacu and GCPwn do for AWS and GCP. The IDCS application lateral movement finding is the real payload: a non-obvious, historically-rooted dual-authorization quirk that most OCI practitioners have never thought through, demonstrated with a concrete attack chain.