<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

# Cloud & Web Enumeration

Cloud asset enumeration, OSINT tooling for username/people intelligence, and cloud-specific attack paths.

## OSINT Tooling (Username, People, Social)

### Sherlock Username Enumeration

```bash
sherlock username --print-found             # show only hits
sherlock username --csv -o results.csv      # CSV output
sherlock username --site Twitter --site GitHub  # target specific sites
sherlock username --timeout 10 --no-color   # CI-friendly
```

### Maigret Deep Username Search (3000+ Sites)

```bash
maigret username --html                     # rich HTML report
maigret username --pdf                      # PDF report
maigret user1 user2 user3 -a               # multi-username, all sites
maigret username --tags photo,dating        # filter by site category
maigret username --tags us                  # US-specific sites
```

### GHunt Google Intelligence

Requires Google auth via browser extension.

```bash
ghunt login                                 # authenticate (browser extension flow)
ghunt email target@gmail.com --json out.json  # full profile from email
ghunt gaia GAIA_ID --json out.json          # lookup by Google account ID
ghunt drive FILE_URL --json out.json        # file/folder metadata
ghunt geolocate BSSID                       # BSSID geolocation
```

### Octosuite GitHub Intelligence

```bash
octosuite user targetname                   # full user profile
octosuite user targetname --repos --page 1 --per-page 100  # enumerate repos
octosuite user targetname --followers --json # follower graph
octosuite repo owner/reponame --commits     # commit history
octosuite org orgname --members --json      # org member enumeration
octosuite search "keyword" --repos          # repo search
```

### Anti-Pattern

Running Sherlock against all 400+ default sites when only needing social media — the `--site` filter cuts runtime from minutes to seconds and reduces OPSEC footprint.

---

## Cloud Recon

### AWS Identity and Permissions Enumeration

```bash
# Identify caller identity (may log to CloudTrail)
aws sts get-caller-identity

# Stealthy identity check (does NOT log to CloudTrail)
aws sqs list-queues   # error response reveals ARN + account ID

# Enumerate IAM permissions via brute-force (noisy — generates CloudTrail)
enumerate-iam.py --access-key $AWS_ACCESS_KEY_ID --secret-key $AWS_SECRET_ACCESS_KEY --session-token $AWS_SESSION_TOKEN

# EC2 metadata service (from inside EC2 instance)
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/
# Get role name, then:
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/<role-name>

# IMDSv2 (requires token)
TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/
```

### IAM Privilege Escalation Paths

- `iam:CreateAccessKey` → create keys for more-privileged user
- `iam:AttachUserPolicy` / `iam:AttachRolePolicy` → attach AdministratorAccess
- `iam:CreatePolicyVersion` → create new version of existing policy with elevated privs
- `iam:AddUserToGroup` → join high-privilege group
- `glue:UpdateDevEndpoint` → inject SSH key, gain shell + role creds

### S3 Enumeration

```bash
# Enumerate public buckets via cloud_enum (reconftw uses this)
cloud_enum -k target-company -l output.log

# Check bucket public access
aws s3 ls s3://bucket-name --no-sign-request    # unauthenticated read test
aws s3 cp s3://bucket-name/sensitive.txt . --no-sign-request
```

### Azure and GCP Metadata

```bash
# Azure IMDS (requires Metadata header)
curl -H "Metadata: true" "http://169.254.169.254/metadata/instance?api-version=2021-02-01"

# GCP metadata (requires Metadata-Flavor header)
curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token"
```

### Subdomain Takeover via Cloud

Check CNAMEs pointing to `*.s3.amazonaws.com`, `*.azurewebsites.net`, `*.cloudapp.azure.com`, `*.github.io` — if the target resource is deleted but DNS still points there, register it and serve content from the target domain.

### Anti-Pattern

Using `sts:GetCallerIdentity` for stealthy AWS recon — it DOES log to CloudTrail. Use SQS ListQueues (errors), which does not log, to passively reveal account ID and ARN.

---
v1.1 | Validated: 2026-03-13
