<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: writing-cloud-misconfiguration-templates
description: >-
  Write Nuclei templates for detecting cloud service misconfigurations across
  AWS, Azure, and GCP. Covers exposed storage buckets, open metadata endpoints,
  IAM policy flaws, serverless misconfigs, and cloud-native service enumeration.
domain: cybersecurity
subdomain: nuclei-templating
tags:
  - nuclei
  - cloud
  - misconfiguration
  - aws
  - azure
  - gcp
  - templates
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1530"]
---

# Writing Cloud Misconfiguration Templates

## Overview

Cloud misconfiguration templates detect insecure settings in cloud provider
services exposed to the internet. These range from open S3 buckets and metadata
endpoints to misconfigured serverless functions and overly permissive CORS
policies. Templates must account for cloud-specific response patterns and
distinguish between access-denied and not-found responses.

Mode: `[MODE: RED]` — Cloud attack surface enumeration and misconfiguration detection.

## Prerequisites

| Requirement | Details |
|---|---|
| Nuclei v3+ (`nuclei -version`) | Required |
| Understanding of AWS, Azure, GCP service architectures | Required |
| Target cloud-hosted applications or infrastructure | Required |

## Key Concepts

### AWS S3 Bucket Misconfiguration

```yaml
id: s3-bucket-listing-enabled

info:
  name: AWS S3 Bucket Directory Listing
  author: nerf
  severity: high
  description: |
    Detects publicly accessible AWS S3 buckets with directory listing
    enabled. Exposed buckets can leak sensitive data including backups,
    configuration files, and user uploads.
  classification:
    cwe-id: CWE-264
  tags: cloud,aws,s3,misconfig,exposure
  metadata:
    max-request: 1
    shodan-query: 'ssl.cert.subject.cn:"s3.amazonaws.com"'

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<ListBucketResult"
          - "<Contents>"
        condition: and
      - type: status
        status:
          - 200
      - type: word
        part: header
        words:
          - "x-amz-request-id"
    extractors:
      - type: regex
        part: body
        regex:
          - '<Name>(.*?)</Name>'
        group: 1
```

### Cloud Metadata Service Exposure

```yaml
id: cloud-metadata-service-ssrf

info:
  name: Cloud Metadata Service SSRF Detection
  author: nerf
  severity: critical
  description: |
    Detects SSRF vulnerabilities that allow access to cloud instance
    metadata services. Successful exploitation yields IAM credentials,
    instance identity tokens, and infrastructure configuration data.
  classification:
    cwe-id: CWE-918
  tags: cloud,ssrf,metadata,aws,gcp,azure,critical
  metadata:
    max-request: 3

http:
  - method: GET
    path:
      - "{{BaseURL}}/?url=http://169.254.169.254/latest/meta-data/"
      - "{{BaseURL}}/?url=http://metadata.google.internal/computeMetadata/v1/"
      - "{{BaseURL}}/?url=http://169.254.169.254/metadata/instance"
    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "ami-id"
          - "instance-id"
          - "computeMetadata"
          - "azEnvironment"
        condition: or
      - type: status
        status:
          - 200
```

### Azure Blob Storage Open Access

```yaml
id: azure-blob-container-listing

info:
  name: Azure Blob Storage Public Container Listing
  author: nerf
  severity: high
  description: |
    Detects Azure Blob Storage containers with public list access
    enabled. Attackers can enumerate all blobs in the container and
    download sensitive files without authentication.
  classification:
    cwe-id: CWE-264
  tags: cloud,azure,blob,misconfig,exposure
  metadata:
    max-request: 1

http:
  - method: GET
    path:
      - "{{BaseURL}}?restype=container&comp=list"
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<EnumerationResults"
          - "<Blob>"
          - "<Name>"
        condition: and
      - type: status
        status:
          - 200
      - type: word
        part: header
        words:
          - "x-ms-request-id"
    extractors:
      - type: regex
        part: body
        regex:
          - '<Name>(.*?)</Name>'
```

### GCP Firebase Database Exposure

```yaml
id: firebase-database-open-read

info:
  name: GCP Firebase Realtime Database Open Read
  author: nerf
  severity: high
  description: |
    Detects Firebase Realtime Databases with public read access enabled.
    Unauthenticated users can dump the entire database contents including
    user data, application state, and configuration.
  classification:
    cwe-id: CWE-200
  tags: cloud,gcp,firebase,misconfig,exposure
  metadata:
    max-request: 1

http:
  - method: GET
    path:
      - "{{BaseURL}}/.json"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        part: header
        words:
          - "application/json"
      - type: dsl
        dsl:
          - 'len(body) > 2'
          - '!contains(body, "Permission denied")'
          - '!contains(body, "null")'
        condition: and
```

## Workflow

### Step 1: Validate Template

```bash
nuclei -t cloud-misconfig.yaml -validate
```

### Step 2: Scan Cloud Target

```bash
node scripts/agent.js --action scan --target https://bucket.s3.amazonaws.com \
  --template cloud-misconfig.yaml --output /tmp/cloud-scan.json
```

### Step 3: Enumerate Cloud Assets

```bash
node scripts/agent.js --action scan --target https://app.example.com \
  --template cloud-ssrf.yaml --output /tmp/cloud-enum.json
```

## Verification

- [ ] Templates handle cloud-specific response headers correctly
- [ ] Negative matchers exclude access-denied and not-found responses
- [ ] Metadata service templates test all three major cloud providers
- [ ] Storage enumeration templates extract resource names
- [ ] No hardcoded cloud account IDs or endpoints
- [ ] `max-request` metadata matches actual request count
- [ ] Templates tested against both misconfigured and secure targets

## References

- [AWS S3 Security Best Practices](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html)
- [Azure Blob Storage Access Control](https://learn.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-overview)
- [GCP Firebase Security Rules](https://firebase.google.com/docs/rules)
- [Nuclei Cloud Templates](https://github.com/projectdiscovery/nuclei-templates/tree/main/http/misconfiguration)
