purpleailab Cloud Infrastructure Reconnaissance Knowledge Base
Cloud reconnaissance identifies cloud-hosted assets, misconfigured storage, exposed services, and cloud-specific attack surfaces. Modern organizations run hybrid infrastructure — cloud recon is essential for complete attack surface mapping.
1. Cloud Provider Detection
Fingerprinting via DNS/Headers
See references/cloud-ip-ranges.md for the full CNAME → provider mapping table and response header fingerprinting. See references/cloud-naming-patterns.md for bucket/resource naming dictionaries.
# Check CNAME records for cloud indicators
dig <target> CNAME +short
# Common cloud CNAME patterns:
# AWS: *.amazonaws.com, *.cloudfront.net, *.elasticbeanstalk.com
# Azure: *.azurewebsites.net, *.blob.core.windows.net, *.azure-api.net
# GCP: *.googleapis.com, *.appspot.com, *.run.app, *.cloudfunctions.net
# Cloudflare: *.cdn.cloudflare.net
# Check IP ranges (AWS)
curl -s https://ip-ranges.amazonaws.com/ip-ranges.json | python3 -c "
import sys, json, ipaddress
data = json.load(sys.stdin)
target = ipaddress.ip_address('<TARGET_IP>')
for prefix in data['prefixes']:
if target in ipaddress.ip_network(prefix['ip_prefix']):
print(f\"AWS Region: {prefix['region']}, Service: {prefix['service']}\")
"
Cloud Service Indicators
| Indicator | Provider | Service |
|---|---|---|
s3.amazonaws.com CNAME |
AWS | S3 Storage |
X-Amz-* headers |
AWS | Various |
X-Ms-* headers |
Azure | Various |
X-Cloud-Trace-Context header |
GCP | Cloud Run/Functions |
*.elasticbeanstalk.com CNAME |
AWS | Elastic Beanstalk |
*.azurewebsites.net CNAME |
Azure | App Service |
*.appspot.com CNAME |
GCP | App Engine |
2. AWS Enumeration
S3 Bucket Discovery
# Common naming patterns
for prefix in <target> <target>-backup <target>-dev <target>-staging \
<target>-prod <target>-assets <target>-uploads <target>-logs \
<target>-data <target>-media www.<target> cdn.<target>; do
# Check if bucket exists
code=$(curl -s -o /dev/null -w "%{http_code}" "https://$prefix.s3.amazonaws.com/")
echo "$code $prefix.s3.amazonaws.com"
done
# Check bucket ACL (if accessible)
curl -s "https://<bucket>.s3.amazonaws.com/?acl"
# List bucket contents (if public)
curl -s "https://<bucket>.s3.amazonaws.com/?list-type=2&max-keys=20"
S3 Bucket Takeover Detection
# If a subdomain CNAMEs to S3 but bucket doesn't exist:
# Response: "NoSuchBucket" → Takeover candidate
curl -s "https://assets.example.com/" | grep -i "NoSuchBucket"
AWS Service Enumeration
# Check for exposed EC2 metadata (SSRF target)
# Internal: http://169.254.169.254/latest/meta-data/
# IMDSv2 requires token — check if v1 is still enabled
# Elastic Beanstalk environment discovery
dig <target>.elasticbeanstalk.com +short
# CloudFront origin detection
curl -sI "https://<target>" | grep -i "x-amz\|x-cache\|via.*cloudfront"
# API Gateway detection
curl -s "https://<api-id>.execute-api.<region>.amazonaws.com/prod/"
3. Azure Enumeration
Azure Blob Storage
# Common storage account patterns
for name in <target> <target>storage <target>data <target>backup \
<target>dev <target>prod; do
code=$(curl -s -o /dev/null -w "%{http_code}" "https://$name.blob.core.windows.net/")
echo "$code $name.blob.core.windows.net"
done
# Enumerate containers (if listing enabled)
curl -s "https://<account>.blob.core.windows.net/<container>?restype=container&comp=list"
# Check for anonymous access
curl -s "https://<account>.blob.core.windows.net/\$web/index.html"
Azure Service Discovery
# Azure App Service
dig <target>.azurewebsites.net +short
# Azure Functions
curl -s "https://<target>.azurewebsites.net/api/<function>"
# Azure API Management
dig <target>.azure-api.net +short
# Azure DevOps (public projects)
curl -s "https://dev.azure.com/<org>/_apis/projects?api-version=7.0"
Azure Subdomain Patterns
*.azurewebsites.net → App Service
*.blob.core.windows.net → Blob Storage
*.table.core.windows.net → Table Storage
*.queue.core.windows.net → Queue Storage
*.file.core.windows.net → File Storage
*.database.windows.net → SQL Database
*.redis.cache.windows.net → Redis Cache
*.vault.azure.net → Key Vault
*.azure-api.net → API Management
*.azureedge.net → CDN
4. GCP Enumeration
GCP Storage Buckets
# Common GCP bucket names
for name in <target> <target>-bucket <target>-backup <target>-data \
<target>.appspot.com <target>-uploads; do
code=$(curl -s -o /dev/null -w "%{http_code}" "https://storage.googleapis.com/$name/")
echo "$code storage.googleapis.com/$name"
done
# List bucket contents (if public)
curl -s "https://storage.googleapis.com/<bucket>/"
GCP Service Discovery
# App Engine
dig <project>.appspot.com +short
# Cloud Run
dig <service>-<hash>-<region>.a.run.app +short
# Cloud Functions
curl -s "https://<region>-<project>.cloudfunctions.net/<function>"
# Firebase
curl -s "https://<project>.firebaseio.com/.json"
5. Multi-Cloud Tools
cloud_enum (Automated Discovery)
# Enumerate across all major cloud providers
cloud_enum -k <target> -l cloud_enum_<target>.txt
# With mutation file
cloud_enum -k <target> -m mutations.txt -l cloud_enum_<target>.txt
Manual Multi-Cloud Checklist
# Run for each target keyword
TARGET="example"
echo "=== AWS ==="
curl -s -o /dev/null -w "%{http_code} " "https://$TARGET.s3.amazonaws.com/" && echo "S3"
echo "=== Azure ==="
curl -s -o /dev/null -w "%{http_code} " "https://$TARGET.blob.core.windows.net/" && echo "Blob"
echo "=== GCP ==="
curl -s -o /dev/null -w "%{http_code} " "https://storage.googleapis.com/$TARGET/" && echo "GCS"
echo "=== Firebase ==="
curl -s -o /dev/null -w "%{http_code} " "https://$TARGET.firebaseio.com/.json" && echo "Firebase"
6. CDN & Origin Detection
Finding Origin IPs Behind CDN
# Check historical DNS records (via SecurityTrails, etc.)
# Check for direct IP disclosure in:
# - Email headers (Received: from)
# - SSL certificate Subject Alternative Names
# - Shodan/Censys searches for the same TLS cert
# Direct IP test
curl -sI -H "Host: <target>" https://<suspected_origin_ip>/ | head -20
7. Serverless & Container Enumeration
Lambda/Functions URL Patterns
# AWS Lambda function URLs
curl -s "https://<id>.lambda-url.<region>.on.aws/"
# Azure Functions
curl -s "https://<app>.azurewebsites.net/api/<func>?code=<key>"
# GCP Cloud Functions
curl -s "https://<region>-<project>.cloudfunctions.net/<func>"
Container Registry Exposure
# Docker Hub
curl -s "https://hub.docker.com/v2/repositories/<org>/" | python3 -m json.tool
# AWS ECR (if misconfigured)
# Azure ACR
curl -s "https://<registry>.azurecr.io/v2/_catalog"
# GCP GCR
curl -s "https://gcr.io/v2/<project>/tags/list"
8. Workflow: Cloud Recon Sequence
- Cloud Detection → DNS CNAMEs, response headers, IP range lookups
- Storage Enumeration → S3/Blob/GCS bucket discovery with naming patterns
- Service Discovery → App services, functions, API gateways
- Access Testing → Check for public listing, anonymous read/write
- Takeover Check → Dangling CNAMEs to unclaimed cloud resources
- Origin Detection → Find real IPs behind CDN
- Container/Registry → Check for exposed container registries
- Document → Add all cloud findings to main report with provider tags
9. Output Files
./
├── cloud_enum_<target>.txt # cloud_enum results
├── s3_buckets_<target>.txt # AWS S3 discovery
├── azure_storage_<target>.txt # Azure blob discovery
├── gcp_buckets_<target>.txt # GCP storage discovery
├── cloud_services_<target>.txt # Discovered cloud services
└── cloud_recon_<target>_summary.md # Consolidated cloud findings