cloud_enum v0.1 releases: Multi-cloud OSINT tool
cloud_enum
Multi-cloud OSINT tool. Enumerate public resources in AWS, Azure, and Google Cloud.
Currently enumerates the following:
Amazon Web Services:
- Open S3 Buckets
- Protected S3 Buckets
Microsoft Azure:
- Storage Accounts
- Open Blob Storage Containers
- Hosted Databases
- Virtual Machines
- Web Apps
Google Cloud Platform
- Open GCP Buckets
- Protected GCP Buckets
- Google App Engine sites
Changelog v0.1
This is a fully functional release of cloud_enum. I actually recommend always pulling from master, but for inclusion in some repositories, we need tagged releases.
This version supports the following:
Amazon Web Services:
- Open S3 Buckets
- Protected S3 Buckets
Microsoft Azure:
- Storage Accounts
- Open Blob Storage Containers
- Hosted Databases
- Virtual Machines
- Web Apps
Google Cloud Platform
- Open GCP Buckets
- Protected GCP Buckets
- Google App Engine sites
Download
git clone https://github.com/initstring/cloud_enum.git
pip3 install -r ./requirements.txt
Use
The only required argument is at least one keyword. This is what will be used to find the names of S3 Buckets, Azure Storage Accounts, and Google Cloud Buckets. This keyword will be mutated by prepending and then appending the strings in cloudenum/mutations.txt.
You can provide multiple keywords by specifying the -k argument multiple times.
Azure Containers required two levels of brute-forcing, both handled automatically by this tool. First, by finding valid accounts. Then, by brute-forcing the name of containers inside that account. That second layer of discovery will use the strings in the cloud_enum/brute.txt file.
Alternatively, you can specify your own mutation and brute files.
Let’s say you were researching “somecompany” whose website is “somecompany.io” that makes a product called “blockchaindoohickey”. You could run the tool like this:
cloudenum.py -k somecompany -k somecompany.io -k blockchaindoohickey
By default, the tool uses 5 HTTP threads for brute-forcing and enumerating. You can try increasing this, but eventually, the cloud providers will rate limit you. Here is an example to increase to 8.
DNS brute-forcing uses a hard-coded 5 threads.
