cloud-recon

Cloud Infrastructure Reconnaissance Knowledge Base

Cloud reconnaissance identifies cloud-hosted assets, misconfigured storage, exposed services, and cloud-specific attack surfaces. Modern organizations run hybrid infrastructure — cloud recon is essential for complete attack surface mapping.

1. Cloud Provider Detection

Fingerprinting via DNS/Headers

See references/cloud-ip-ranges.md for the full CNAME → provider mapping table and response header fingerprinting. See references/cloud-naming-patterns.md for bucket/resource naming dictionaries.

# Check CNAME records for cloud indicators
dig <target> CNAME +short

# Common cloud CNAME patterns:
# AWS:       *.amazonaws.com, *.cloudfront.net, *.elasticbeanstalk.com
# Azure:     *.azurewebsites.net, *.blob.core.windows.net, *.azure-api.net
# GCP:       *.googleapis.com, *.appspot.com, *.run.app, *.cloudfunctions.net
# Cloudflare: *.cdn.cloudflare.net

# Check IP ranges (AWS)
curl -s https://ip-ranges.amazonaws.com/ip-ranges.json | python3 -c "
import sys, json, ipaddress
data = json.load(sys.stdin)
target = ipaddress.ip_address('<TARGET_IP>')
for prefix in data['prefixes']:
    if target in ipaddress.ip_network(prefix['ip_prefix']):
        print(f\"AWS Region: {prefix['region']}, Service: {prefix['service']}\")
"

Cloud Service Indicators

Indicator	Provider	Service
s3.amazonaws.com CNAME	AWS	S3 Storage
X-Amz-* headers	AWS	Various
X-Ms-* headers	Azure	Various
X-Cloud-Trace-Context header	GCP	Cloud Run/Functions
*.elasticbeanstalk.com CNAME	AWS	Elastic Beanstalk
*.azurewebsites.net CNAME	Azure	App Service
*.appspot.com CNAME	GCP	App Engine

2. AWS Enumeration

S3 Bucket Discovery

# Common naming patterns
for prefix in <target> <target>-backup <target>-dev <target>-staging \
    <target>-prod <target>-assets <target>-uploads <target>-logs \
    <target>-data <target>-media www.<target> cdn.<target>; do
    # Check if bucket exists
    code=$(curl -s -o /dev/null -w "%{http_code}" "https://$prefix.s3.amazonaws.com/")
    echo "$code $prefix.s3.amazonaws.com"
done

# Check bucket ACL (if accessible)
curl -s "https://<bucket>.s3.amazonaws.com/?acl"

# List bucket contents (if public)
curl -s "https://<bucket>.s3.amazonaws.com/?list-type=2&max-keys=20"