Introduction to Cloud Reconnaissance#

Modern companies increasingly rely on cloud services (AWS, GCP, Azure) for their operations. While cloud providers secure their infrastructure, misconfigurations by administrators can leave company assets vulnerable - particularly with storage services like S3 buckets, Azure blobs, and GCP cloud storage.

Identifying Cloud Resources Through DNS#

DNS Enumeration Technique#

Cloud storage endpoints often appear in DNS records for easier employee access. Here’s how to identify them:

for i in $(cat subdomainlist); do 
  host $i | grep "has address" | grep inlanefreight.com
done

Sample Output:

blog.inlanefreight.com 10.129.24.93
inlanefreight.com 10.129.27.33
matomo.inlanefreight.com 10.129.127.22
www.inlanefreight.com 10.129.127.33
s3-website-us-west-2.amazonaws.com 10.129.95.250  # Cloud resource identified`

Cloud Discovery Methods#

1. Google Dorking#

Powerful search operators can uncover exposed cloud resources:

Example Dorks:

• inurl.amazonaws.com intext
• inurl.core.windows.net intext
• filetypesite.googleapis.com

2. Source Code Analysis#

Web page sources often reference cloud storage for assets:

• Check for references in:
  • JavaScript files
  • CSS imports
  • Image sources
  • API endpoints

3. Third-Party Tools#

Domain.Glass#

Provides infrastructure insights including:

• Cloudflare security status
• DNS configurations
• Hosting provider details

GrayHatWarfare#

Specialized cloud storage search engine with:

• Multi-cloud support (AWS/Azure/GCP)
• File format filtering
• Bulk search capabilities

Advanced Discovery Techniques#

Company Nomenclature Patterns#

Many organizations use naming conventions:

• Abbreviations (e.g., acme → acm-corp)
• Department codes (e.g., hr-acme)
• Project names (e.g., projectx-storage)

File-Specific Searches#

Combine storage discovery with file hunting:

site:s3.amazonaws.com filetype:pdf "confidential"

Common Cloud Misconfigurations#

Defensive Considerations#

1. Regular Audits: Periodic checks of cloud permissions
2. Access Logging: Enable and monitor storage access logs
3. Least Privilege: Restrict permissions to minimum requirements
4. Sensitive Data: Never store in publicly accessible locations