{"id":4380,"date":"2024-09-15T14:50:15","date_gmt":"2024-09-15T12:50:15","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=4380"},"modified":"2024-09-15T20:24:18","modified_gmt":"2024-09-15T18:24:18","slug":"cloud-enumeration","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=4380","title":{"rendered":"Cloud Enumeration"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Initial (network) enumeration<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Check where a ser\u00advice is host\u00aded by quer\u00ading the name\u00adserv\u00ader records for our tar\u00adget domain:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">host -t ns $domain<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Get more infor\u00adma\u00adtion \/ con\u00adfir\u00adma\u00adtion via a whois query to one pre\u00advi\u00adous\u00adly found domain.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">whois $previouslyFoundDomain<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Check where a host is running:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">host $domain<br>host $ipFromTheDomain<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Check more domains of this organ\u00adi\u00adsa\u00adtion \/ of this domain:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">dnsenum $domain --threads 100<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Get more zone information:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">dig $domain ANY<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If there is a web ser\u00advice avail\u00adable: Check in the sources \/ net\u00adwork requests if there are requests to a cloud-based ser\u00advice. For exam\u00adple, if there are requests to <span class=\"caps\">AWS<\/span> <span class=\"caps\">S3<\/span>, you have a buck\u00adet&nbsp;name!<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>If you have one, go to the root \/ check sub\u00addi\u00adrec\u00adto\u00adries if some\u00adwhere pub\u00adlic list\u00ading is active.<\/li>\n\n\n\n<li>If the struc\u00adture of a buck\u00adet give an indi\u00adca\u00adtion for anoth\u00ader buck\u00adet, check it out. E.g. if you have a buck\u00adet called <code>comp-dev-assets<\/code>, try <code>comp-prod-assets<\/code>, etc.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Try to enu\u00admer\u00adate with cloud_enum. A $key\u00adword could be the name of a <span class=\"caps\">S3<\/span> buck\u00adet, an <span class=\"caps\">EC2<\/span> instance, etc. You could add mul\u00adti\u00adple in an exter\u00adnal file (e.g. with dev, test, prod, \u2026) Dis\u00adable oth\u00ader cloud providers or&nbsp;none.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">cloud_enum -k $keyword --quickscan [--disable-aws --disable-azure --disable-gcp] \/\/ one keyword<br>cloud_enum -kf \/tmp\/keywords --quickscan [--disable-aws --disable-azure --disable-gcp] \/\/ multiple keywords in an external file<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">See also<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/andreas-klingler.de\/infosec\/?p=1715\" data-type=\"post\" data-id=\"1715\"><span class=\"caps\">AWS<\/span> Ama\u00adzon Web Ser\u00advice Enumeration<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Ini\u00adtial (net\u00adwork) enu\u00admer\u00ada\u00adtion Check where a ser\u00advice is host\u00aded by quer\u00ading the name\u00adserv\u00ader records for our tar\u00adget domain: host \u2011t ns $domain Get more infor\u00adma\u00adtion \/ con\u00adfir\u00adma\u00adtion via a whois query to one pre\u00advi\u00adous\u00adly found domain. whois $pre\u00advi\u00adous\u00adly\u00adFound\u00adDo\u00admain Check where a host is run\u00adning: host $domain\u00adhost $ipFromThe\u00adDo\u00admain Check more domains of this organ\u00adi\u00adsa\u00adtion \/&nbsp;of&nbsp;[\u2026]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[469,470],"tags":[287,304],"class_list":["post-4380","post","type-post","status-publish","format-standard","hentry","category-passive-enum","category-active-enum","tag-aws","tag-cloud"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/4380","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4380"}],"version-history":[{"count":8,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/4380\/revisions"}],"predecessor-version":[{"id":4412,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/4380\/revisions\/4412"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4380"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4380"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4380"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}