Initial (network) enumeration

Check where a ser­vice is host­ed by quer­ing the name­serv­er records for our tar­get domain:

host -t ns $domain

Get more infor­ma­tion / con­fir­ma­tion via a whois query to one pre­vi­ous­ly found domain.

whois $previouslyFoundDomain

Check where a host is running:

host $domain
host $ipFromTheDomain

Check more domains of this organ­i­sa­tion / of this domain:

dnsenum $domain --threads 100

Get more zone information:

dig $domain ANY

If there is a web ser­vice avail­able: Check in the sources / net­work requests if there are requests to a cloud-based ser­vice. For exam­ple, if there are requests to AWS S3, you have a buck­et name!

• If you have one, go to the root / check sub­di­rec­to­ries if some­where pub­lic list­ing is active.
• If the struc­ture of a buck­et give an indi­ca­tion for anoth­er buck­et, check it out. E.g. if you have a buck­et called comp-dev-assets, try comp-prod-assets, etc.

Try to enu­mer­ate with cloud_enum. A $key­word could be the name of a S3 buck­et, an EC2 instance, etc. You could add mul­ti­ple in an exter­nal file (e.g. with dev, test, prod, …) Dis­able oth­er cloud providers or none.

cloud_enum -k $keyword --quickscan [--disable-aws --disable-azure --disable-gcp] // one keyword
cloud_enum -kf /tmp/keywords --quickscan [--disable-aws --disable-azure --disable-gcp] // multiple keywords in an external file

See also

• AWS Ama­zon Web Ser­vice Enumeration