cloud_enum v0.1 releases: Multi-cloud OSINT tool


Multi-cloud OSINT tool. Enumerate public resources in AWS, Azure, and Google Cloud.

Currently enumerates:

  • Open Amazon S3 Buckets
  • Protected Amazon S3 Buckets
  • Microsoft Azure Storage Accounts
  • Open Microsoft Azure Containers
  • Registered Azure Website DNS (PaaS web apps)
  • Open Google Cloud Platform Buckets
  • Protected Google Cloud Platform Buckets

Changelog v0.1

This is a fully functional release of cloud_enum. I actually recommend always pulling from master, but for inclusion in some repositories we need tagged releases.

This version supports the following:

Amazon Web Services:

  • Open S3 Buckets
  • Protected S3 Buckets

Microsoft Azure:

  • Storage Accounts
  • Open Blob Storage Containers
  • Hosted Databases
  • Virtual Machines
  • Web Apps

Google Cloud Platform

  • Open GCP Buckets
  • Protected GCP Buckets
  • Google App Engine sites


git clone
pip3 install -r ./requirements.txt

The only required argument is at least one keyword. This is what will be used to find the names of S3 Buckets, Azure Storage Accounts, and Google Cloud Buckets. This keyword will be mutated by prepending and then appending the strings in cloudenum/mutations.txt.

You can provide multiple keywords by specifying the -k argument multiple times.

Azure Containers required two levels of brute-forcing, both handled automatically by this tool. First, by finding valid accounts. Then, by brute-forcing the name of containers inside that account. That second layer of discovery will use the strings in the cloud_enum/brute.txt file.

Alternatively, you can specify your own mutation and brute files.

Let’s say you were researching “somecompany” whose website is “” that makes a product called “blockchaindoohickey”. You could run the tool like this: -k somecompany -k -k blockchaindoohickey

By default, the tool uses 5 HTTP threads for brute-forcing and enumerating. You can try increasing this, but eventually, the cloud providers will rate limit you. Here is an example to increase to 8.

DNS brute-forcing uses a hard-coded 5 threads. -k keyword -t 8

Copyright (C) 2019 initstring


Anastasis Vasileiadis

PC Technical || Penetration Tester || Ethical Hacker || Cyber Security Expert || Cyber Security Analyst || Information Security Researcher || Malware analyst || Malware Investigator || Reverse Engineering

SC ProDefence SRL - Cyber Security Services