Breaking the Oracle: Building an Offensive Security Toolkit for OCI

Oracle Cloud Infrastructure (OCI) is arguably one of the lesser-explored major cloud platforms from an offensive security perspective. While OCI shares many familiar IAM concepts with AWS and GCP, its identity architecture—including sentence-based IAM policies, identity domains, dynamic groups, compartment hierarchies, and cross-tenancy permissions—creates authorization relationships and privilege escalation paths that benefit from OCI-specific analysis.

To help tackle these challenges, I built OCInferno, an open-source OCI reconnaissance framework for offensive security assessments. Alongside oci-lexer-parser, an ANTLR-based parser for OCI’s sentence-based IAM policies, and OCISigner, a Burp Suite extension for transparently signing OCI API requests, a pentester/blue teamer can automate enumeration, model OCI IAM relationships, and build OpenGraph-based attack paths similar to BloodHound to help visualize privilege escalation opportunities.

This talk will demonstrate how to model OCI IAM relationships and uncover OCI-specific attack paths that are difficult to spot from policy text alone. It will also cover a security issue I uncovered that was acknowledged by Oracle in the June 2026 Critical Security Patch Update under its Security-in-Depth program, illustrating how offensive security research can uncover weaknesses not only in customer environments but in the cloud platform itself.