Multi-cloud OSINT tool. Enumerate public resources in AWS, Azure, and Google Cloud.
- Open Amazon S3 Buckets
- Protected Amazon S3 Buckets
- Microsoft Azure Storage Accounts
- Open Microsoft Azure Containers
- Registered Azure Website DNS (PaaS web apps)
- Open Google Cloud Platform Buckets
- Protected Google Cloud Platform Buckets
This is a fully functional release of cloud_enum. I actually recommend always pulling from master, but for inclusion in some repositories we need tagged releases.
This version supports the following:
Amazon Web Services:
- Open S3 Buckets
- Protected S3 Buckets
- Storage Accounts
- Open Blob Storage Containers
- Hosted Databases
- Virtual Machines
- Web Apps
Google Cloud Platform
- Open GCP Buckets
- Protected GCP Buckets
- Google App Engine sites
git clone https://github.com/initstring/cloud_enum.git
pip3 install -r ./requirements.txt
The only required argument is at least one keyword. This is what will be used to find the names of S3 Buckets, Azure Storage Accounts, and Google Cloud Buckets. This keyword will be mutated by prepending and then appending the strings in cloudenum/mutations.txt.
You can provide multiple keywords by specifying the -k argument multiple times.
Azure Containers required two levels of brute-forcing, both handled automatically by this tool. First, by finding valid accounts. Then, by brute-forcing the name of containers inside that account. That second layer of discovery will use the strings in the cloud_enum/brute.txt file.
Alternatively, you can specify your own mutation and brute files.
Let’s say you were researching “somecompany” whose website is “somecompany.io” that makes a product called “blockchaindoohickey”. You could run the tool like this:
cloudenum.py -k somecompany -k somecompany.io -k blockchaindoohickey
By default, the tool uses 5 HTTP threads for brute-forcing and enumerating. You can try increasing this, but eventually, the cloud providers will rate limit you. Here is an example to increase to 8.
DNS brute-forcing uses a hard-coded 5 threads.
cloudenum.py -k keyword -t 8
Copyright (C) 2019 initstring