<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-cloud-infrastructure-reconnaissance
description: >-
  Discover and map cloud infrastructure including S3 buckets, Azure blobs,
  GCP storage, cloud-hosted services, and misconfigured cloud resources
  across AWS, Azure, and GCP environments.
domain: cybersecurity
subdomain: osint-recon
tags:
  - cloud-recon
  - s3-buckets
  - azure-blobs
  - gcp-storage
  - cloud-enumeration
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: >-
  cloud_enum, S3Scanner, AWSBucketDump, grayhatwarfare, ScoutSuite,
  CloudBrute, MicroBurst, Prowler, httpx, nuclei.
metadata:
  mitre-attack:
    - "T1580"      # Cloud Infrastructure Discovery
    - "T1526"      # Cloud Service Discovery
    - "T1530"      # Data from Cloud Storage
    - "T1538"      # Cloud Service Dashboard
---

# Performing Cloud Infrastructure Reconnaissance

## Overview

Cloud infrastructure reconnaissance identifies an organization's cloud
resources across AWS, Azure, and GCP. This includes storage buckets, serverless
functions, virtual machines, databases, and container registries exposed to the
internet. Misconfigured cloud storage remains one of the most common sources of
data exposure. Effective cloud recon combines DNS analysis, brute-forcing of
common naming patterns, and API enumeration.

## Prerequisites

- cloud_enum for multi-cloud enumeration
- S3Scanner for AWS bucket discovery
- CloudBrute for brute-force cloud resource discovery
- nuclei with cloud misconfiguration templates
- AWS CLI, Azure CLI, gcloud CLI for authenticated enumeration

```bash
pip install cloud_enum s3scanner
go install github.com/0xsha/CloudBrute@latest
pip install scoutsuite prowler
```

## Quick Reference

| Task | Command |
|------|---------|
| Multi-cloud enum | `cloud_enum -k target -k target.com --disable-gcp` |
| S3 brute | `s3scanner --bucket-file wordlist.txt --dump-open` |
| GrayHatWarfare | `curl -s "https://buckets.grayhatwarfare.com/api/v2/files?keywords=target&access_token=$GHW_KEY"` |
| DNS cloud detect | `dig +short target.com CNAME \| grep -iE 's3\|blob\|storage\|cloudfront\|appspot'` |
| CloudBrute | `CloudBrute -d target.com -k target -w wordlist.txt -c 50` |
| Nuclei cloud | `nuclei -l urls.txt -t http/misconfiguration/cloud/ -silent` |
| S3 bucket check | `aws s3 ls s3://target-bucket --no-sign-request 2>&1` |
| Azure blob check | `curl -sI "https://targetaccount.blob.core.windows.net/container?restype=container&comp=list"` |

## Workflow

### Step 1: Cloud Resource Discovery

```bash
# cloud_enum — multi-cloud brute-force
cloud_enum -k target -k targetcorp -k target.com -l cloud_enum.log

# CloudBrute — parallel cloud brute-forcing
CloudBrute -d target.com -k target -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
  -c 50 -T 10

# DNS-based cloud detection
dig +short target.com CNAME | grep -iE 's3|blob|storage|cloudfront|appspot|elasticbeanstalk'
cat subdomains.txt | dnsx -silent -cname -resp | grep -iE 'amazonaws|azure|googleapis'
```

### Step 2: AWS S3 Bucket Enumeration

```bash
# S3Scanner — discover and check permissions
s3scanner scan --bucket-file target_buckets.txt --dump-open

# Manual S3 bucket check
aws s3 ls s3://target-company --no-sign-request
aws s3 ls s3://target-backups --no-sign-request

# Check bucket ACL
aws s3api get-bucket-acl --bucket target-company --no-sign-request 2>&1

# Generate bucket name permutations
for prefix in "" "dev-" "staging-" "prod-" "backup-"; do
  for suffix in "" "-data" "-backup" "-assets" "-logs"; do
    echo "${prefix}target${suffix}"
  done
done > bucket_wordlist.txt
```

### Step 3: Azure and GCP Enumeration

```bash
# Azure Blob Storage
curl -sI "https://targetaccount.blob.core.windows.net/\$web?restype=container&comp=list"
curl -sI "https://targetaccount.blob.core.windows.net/public?restype=container&comp=list"

# GCP Storage
curl -s "https://storage.googleapis.com/target-bucket/"
gsutil ls gs://target-bucket/ 2>&1

# Azure App Services
curl -sI "https://target.azurewebsites.net/" | head -5
curl -sI "https://target.scm.azurewebsites.net/" | head -5
```

### Step 4: Cloud Misconfiguration Scanning

```bash
# Nuclei — cloud misconfiguration templates
nuclei -l cloud_urls.txt -t http/misconfiguration/ -t http/exposures/ \
  -silent -json -o cloud_misconfig.json

# GrayHatWarfare — search exposed buckets
curl -s "https://buckets.grayhatwarfare.com/api/v2/files?keywords=target&access_token=$GHW_KEY" \
  | jq '.files[] | {url, bucket, filename}'
```

### Step 5: Cloud Service Fingerprinting

```bash
# Identify cloud-hosted services via response headers
httpx -l subdomains.txt -silent -json | \
  jq 'select(.header | test("AmazonS3|x-ms-|x-goog-")) | {url, status_code}'

# Detect cloud WAFs and load balancers
curl -sI https://target.com | grep -iE 'x-amz|x-ms-|x-goog|cf-ray|x-azure'
```

## Detection Opportunities

- Brute-force bucket enumeration generates predictable HTTP patterns
- S3 access attempts log to CloudTrail (if enabled)
- Azure Storage analytics track anonymous access attempts
- Cloud provider rate limiting may activate on bulk enumeration

## Verification

- [ ] AWS S3 buckets enumerated and permissions checked
- [ ] Azure Blob Storage accounts discovered and tested
- [ ] GCP Storage buckets identified
- [ ] Cloud-hosted services fingerprinted via headers
- [ ] Misconfigured resources documented with access levels
- [ ] Results correlated with DNS and subdomain findings

## References

- [cloud_enum](https://github.com/initstring/cloud_enum)
- [S3Scanner](https://github.com/sa7mon/S3Scanner)
- [GrayHatWarfare](https://buckets.grayhatwarfare.com/)
- [CloudBrute](https://github.com/0xsha/CloudBrute)
- [ScoutSuite](https://github.com/nccgroup/ScoutSuite)
- [Nuclei Templates](https://github.com/projectdiscovery/nuclei-templates)

---
v1.0 | Validated: 2026-03-17
