cloud-audit

Cloud Infrastructure Audit Playbook

Philosophy

Cloud misconfigs are the highest-signal, lowest-effort findings in modern pentests. One SSRF to 169.254.169.254 = IAM creds = all S3 = all Secrets Manager = game over. Never claim "cloud compromise" without demonstrating actual data access with real credentials.

Arguments

<target> - domain or AWS account ID <focus> - optional: AWS / GCP / AZURE / K8S / FULL

---

Phase 0: Smart Intake

source ~/.claude/skills/_shared/phase0.sh
source ~/.claude/skills/_shared/signals.sh

p0_init_vars "$1"
p0_state_gate "HARVEST" || exit 0
p0_read_relay recon secrets exploit
p0_read_memory
p0_read_hypotheses

AWS_KEYS=$AWS_KEYS_FOUND  # alias to match downstream references

echo "=== PHASE 0 CLOUD-AUDIT INTAKE: $TARGET ==="
echo "State: $STATE"
echo "AWS keys found: $AWS_KEYS | SSRF vectors: $(echo "$SSRF_VECTORS" | wc -l)"
echo "AWS/GCP/Azure hints: $AWS_HINT/$GCP_HINT/$AZURE_HINT"
echo "ATW flagged (avoid): ${ATW_FLAGGED:-none}"

Execution Manifest

# Manifest is dynamic: only include phases for confirmed cloud providers
# MUST items = confirmed via prior intel. SHOULD = hinted. IF_TIME = speculative.

MANIFEST=$(cat << 'MANIFEST_EOF'
{
  "phase": "cloud-audit",
  "generated_at": "YYYY-MM-DD HH:MM",
  "items": [
    {"id":"c01","tool":"cloud-footprint-discovery","target":"<target>","reason":"identify cloud provider from DNS/headers","priority":"MUST","status":"pending","skip_reason":null},
    {"id":"c02","tool":"s3-bucket-enum","target":"<target-brand>","reason":"find exposed S3/GCS/Azure blob buckets","priority":"MUST","status":"pending","skip_reason":null},
    {"id":"c03","tool":"imds-ssrf","target":"<ssrf-endpoint-from-exploit-relay>","reason":"SSRF->IMDS credential theft if SSRF_VECTORS found","priority":"MUST","status":"pending","skip_reason":"set to skipped if no SSRF_VECTORS"},
    {"id":"c04","tool":"aws-iam-enum","target":"credentials from SSRF or secrets","reason":"enumerate IAM permissions, privesc paths","priority":"MUST","status":"pending","skip_reason":"set to skipped if no AWS credentials"},
    {"id":"c05","tool":"aws-data-exfil","target":"S3/SecretsManager/SSM/Lambda","reason":"extract actual sensitive data to prove impact","priority":"MUST","status":"pending","skip_reason":null},
    {"id":"c06","tool":"gcp-metadata-enum","target":"<ssrf-endpoint>","reason":"GCP SA token via metadata if GCP_HINT=true","priority":"SHOULD","status":"pending","skip_reason":"skip if GCP_HINT=false"},
    {"id":"c07","tool":"azure-imds","target":"<ssrf-endpoint>","reason":"Azure managed identity token if AZURE_HINT=true","priority":"SHOULD","status":"pending","skip_reason":"skip if AZURE_HINT=false"},
    {"id":"c08","tool":"k8s-api-probe","target":"<live-hosts>:6443","reason":"exposed K8s API server","priority":"IF_TIME","status":"pending","skip_reason":null},
    {"id":"c09","tool":"cloud-misconfiguration-checklist","target":"<account>","reason":"IAM wildcard, SGgroups, CloudTrail disabled","priority":"SHOULD","status":"pending","skip_reason":null}
  ]
}
MANIFEST_EOF
)

jq --argjson m "$MANIFEST" '.scalpel.active_manifest = $m' $SESSION > /tmp/s.json && mv /tmp/s.json $SESSION