Cloud And Infra

Cloud & Infrastructure OSINT

Sub-skill of offensive-osint. Load osint-methodology for pipeline and triage context. Authorized targets only.

BEHAVIORAL CONTRACT

When triggered: Cloud-native service fingerprinting, Kubernetes/container exposure, CI/CD platform exposure, TLS deep audit, or container registry leak hunting is needed.

Execute:

1. For each discovered subdomain/IP, match against cloud-native URL patterns (§1). Classify provider and service type.
2. Check public-vs-auth-required on each cloud function endpoint (HEAD/GET).
3. For K8s/container exposure: probe ports from §2 table (Docker 2375/2376, kubelet 10250, etcd 2379, K8s API 6443/8443). Anonymous access = CRITICAL.
4. Check CI/CD platforms (§3) for unauthenticated access.
5. Run TLS deep audit (§4) on every HTTPS endpoint in scope.
6. Check public container registries (§2) for target-owned images.
7. For each finding, emit per osint-methodology §3 schema.

Output: Infrastructure findings with provider, service type, auth posture, severity. All per osint-methodology §3 schema.

Severity rules: Inline per section tables. Docker API unencrypted = CRITICAL. Open kubelet = CRITICAL. Open etcd = CRITICAL. K8s API anonymous = HIGH. TLS 1.0/1.1 = MEDIUM.

Gating rules: Active port probing is HIGH detectability — confirm authorization. Container image pulls generate logs — note detectability.

Chain to: Feed discovered cloud endpoints to web-surface for HTTP checks. Feed K8s findings to analysis-and-reporting for attack-path hints. For ASN/BGP lookups, use recon-asset-discovery.

1. Cloud-Native Service Fingerprints

Per-platform checks:

• Confirm public vs auth-required (HEAD / GET).
• Check CORS posture.
• Lambda Function URLs / Cloud Run / Cloud Functions: anonymous invocation = HIGH finding.
• Static + functions hybrids (Vercel/Netlify): function paths usually /api/*; enumerate via JS extraction.

2. Container & Kubernetes Exposure

Container registries to check for leaks:

Per-image scan workflow:

docker pull <registry>/<image>:<tag>
docker save <image> -o /tmp/img.tar
# Extract layers; run secret catalog over files
docker history <image>   # inspect build args + COPY of secrets

3. CI/CD Platform Exposure

GitHub Actions secret-leak anti-patterns:

# Anti-pattern: secret echoed to log
run: echo "${{ secrets.MY_API_KEY }}"

# Anti-pattern: pull_request_target with fork code checkout (CVE class)
on: pull_request_target
jobs:
  test:
    steps:
      - uses: actions/checkout@v3
        with:
          ref: ${{ github.event.pull_request.head.sha }} # checks out fork code with secrets in env

4. TLS Deep Audit

Beyond cert SAN + JARM — inspect cipher suites, protocols, and config quality.

# sslyze (most thorough — install: see docs/reference/tooling-install.md)
sslyze --regular target.example:443
sslyze --json_out=tls.json target.example:443

# testssl.sh (thorough + readable)
docker run --rm -ti drwetter/testssl.sh https://target.example
testssl.sh --jsonfile-pretty=tls-report.json target.example:443

# nmap (lighter)
nmap --script ssl-enum-ciphers,ssl-cert -p 443 target.example

Issues to check:

JA3/JA4 reference databases:

• ja3er.com — JA3 → client-software mapping.
• Shodan ssl.jarm:<hash> to find shared infrastructure / origin candidates.

5. Favicon mmh3 Hash Pivot

python3 -c "
import urllib.request, codecs, mmh3
data = urllib.request.urlopen('https://target.example/favicon.ico').read()
print(mmh3.hash(codecs.encode(data, 'base64')))"
shodan search "http.favicon.hash:<hash>" --fields ip_str,port,org

Note: For ASN/BGP and internet measurement, see recon-asset-discovery. For reverse DNS sweep and IPv6 enumeration scripts, see docs/methods/active-sweep-scripts.md.

Structured Outrider run contract

Follow the shared run-contract instructions in ../_shared/run-contract.md.

• Contract skill identifier: cloud-and-infra.
• Consume skill_request version 1 and produce skill_result version 1 when participating in an Outrider run.
• Use evidence IDs for all claims; do not cite unregistered local paths as claim evidence.
• Discoveries are observations and do not expand scope or approval.
• Do not claim final finding validation; use finding_candidate only when a human-reviewed candidate should be handed off.
• Do not directly edit manifest.json, scope.yaml, run.jsonl, evidence.jsonl, or approvals.jsonl.
• Use policy-gated MCP with the explicit run_dir; the Python control layer and MCP boundary must reevaluate current controls.