AWS cloud attacks: recon to authenticated enumeration

Cloud attack notes, AWS-first for now — external reconnaissance of a target's cloud footprint, public storage discovery, and authenticated API enumeration once you hold a key. Expands into IAM privilege escalation and the other CSPs as I work through them.

#Mapping the cloud footprint from DNS

Cloud providers leave fingerprints in DNS. Authoritative nameservers and reverse lookups tell you which CSP and which services are in play:

host -t ns offseclab.io          # ns-*.awsdns-*  → Route 53, so AWS
host www.offseclab.io            # → public IP
host 52.70.117.69                # reverse → ec2-52-70-117-69.compute-1.amazonaws.com (EC2)
whois 52.70.117.69 | grep OrgName   # OrgName: Amazon Technologies Inc.
dnsenum offseclab.io --threads 100

The PTR naming (ec2-….compute-1.amazonaws.com, ….s3.amazonaws.com) tells you the service before you send a single authenticated request.

#Public storage discovery (S3)

cloud_enum checks for open buckets and other public resources against a keyword. Start from the org's naming pattern:

sudo apt install cloud-enum
cloud_enum -k offseclab-assets-public-axevtewi --quickscan --disable-azure --disable-gcp
# OPEN S3 BUCKET: http://offseclab-assets-public-axevtewi.s3.amazonaws.com/  (+ lists files)

Once you spot the pattern (<org>-assets-<env>-<suffix>), generate a keyfile of likely names and re-run:

for key in public private dev prod development production; do
  echo "offseclab-assets-$key-axevtewi"
done | tee /tmp/keyfile.txt

cloud_enum -kf /tmp/keyfile.txt -qs --disable-azure --disable-gcp

Private buckets that reject anonymous access become targets again the moment you obtain credentials.

#Authenticated API enumeration (AWS CLI)

With a key (from a leaked config, an SSRF against instance metadata, a public bucket, etc.), configure a named profile — profiles keep multiple identities straight and make switching trivial:

aws configure --profile attacker      # paste Access Key ID + Secret, region, json
aws --profile attacker sts get-caller-identity
# { "UserId": "...", "Account": "123456789012", "Arn": "arn:aws:iam::...:user/attacker" }

sts get-caller-identity is the first call on any new key — it confirms the key works and tells you exactly which principal you are before you enumerate permissions and hunt for a privilege-escalation path through IAM.