cloud-pivot-finder

Name: cloud-pivot-finder
Author: Orizon-eu

18stars4forks

How to install cloud-pivot-finder?

orizon-eu/claude-code-pentest/cloud-pivot-finder

$npx -y skills add Orizon-eu/claude-code-pentest --skill cloud-pivot-finder

Installs into the current project.

Summary

Maps cloud infrastructure from domains and identifies pivot paths from external to cloud internals. Detects cloud providers, enumerates S3/GCS/Azure storage, finds subdomain takeover opportunities, discovers serverless functions, CI/CD exposure, and IaC leaks. Use when user asks

Files · 1

View on GitHub

SKILL.md

1	# Cloud Pivot Finder
2
3	From external domains to cloud infrastructure compromise paths.
4
5	## Important
6
7	CRITICAL: Only test cloud infrastructure you have explicit authorization to test. Unauthorized access to cloud resources is a criminal offense.
8
9	## Instructions
10
11	### Step 1: Cloud Provider Detection
12
13	```bash
14	python scripts/cloud_detector.py --domain {target_domain}
15	```
16
17	Identify cloud hosting:
18	1. IP range analysis: Match IPs against AWS, GCP, Azure published IP ranges
19	2. DNS analysis: CNAME patterns (.amazonaws.com, .googleusercontent.com, *.azurewebsites.net)
20	3. Header analysis: Server headers, X-Amz-, X-GUploader-, x-ms-* headers
21	4. Certificate analysis: Issuer and SAN entries pointing to cloud services
22	5. CDN detection: CloudFront, Cloud CDN, Azure CDN distributions
23
24	Output: Map of domain -> cloud provider -> service type.
25
26	### Step 2: Storage Bucket Enumeration
27
28	```bash
29	python scripts/bucket_enum.py --domain {target_domain} --provider {aws\|gcp\|azure\|all}
30	```
31
32	Naming pattern brute-force:
33	- {domain}, {domain}-backup, {domain}-dev, {domain}-staging
34	- {company}-assets, {company}-uploads, {company}-data
35	- {project}-{env} combinations
36
37	Per-provider testing:
38	- S3: Check for public ListBucket, GetObject, PutObject
39	- GCS: Check for allUsers/allAuthenticatedUsers permissions
40	- Azure Blob: Check for public container access
41
42	For each accessible bucket:
43	1. List contents (if ListBucket allowed)
44	2. Check for sensitive files (.env, credentials, backups, database dumps)
45	3. Test write access (attempt to upload test file, delete immediately)
46	4. Check bucket policy for overly permissive configurations
47
48	### Step 3: Subdomain Takeover Detection
49
50	```bash
51	python scripts/takeover_scanner.py --subdomains {subdomain_list}
52	```
53
54	Check every subdomain's CNAME for dangling references:
55	- AWS: S3, CloudFront, Elastic Beanstalk, ELB
56	- Azure: Azure Websites, Traffic Manager, CDN, Blob
57	- GCP: Cloud Storage, App Engine, Firebase
58	- Other: Heroku, GitHub Pages, Fastly, Shopify, Zendesk, Unbounce, Surge.sh
59
60	For each dangling CNAME:
61	1. Verify the target is actually unclaimed
62	2. Determine the takeover method
63	3. Assess impact (cookie scope, same-origin policy implications)
64	4. Generate takeover PoC instructions
65
66	### Step 4: Serverless and Container Discovery
67
68	```bash
69	python scripts/serverless_finder.py --domain {target_domain}
70	```
71
72	Discover:
73	- Lambda Function URLs: {function-id}.lambda-url.{region}.on.aws
74	- API Gateway: {api-id}.execute-api.{region}.amazonaws.com
75	- Cloud Functions: {region}-{project}.cloudfunctions.net
76	- Cloud Run: *.run.app
77	- Azure Functions: {app}.azurewebsites.net/api/
78	- Container registries: ECR, GCR, ACR public images
79
80	Test each for:
81	- Unauthenticated access
82	- Error messages revealing internal details
83	- Excessive function output (debug mode)
84
85	### Step 5: CI/CD and IaC Exposure
86
87	```bash
88	python scripts/cicd_finder.py --domain {target_domain}
89	```
90
91	Search for:
92	- Exposed CI/CD: Jenkins, GitLab CI, GitHub Actions artifacts
93	- Terraform state files: .tfstate files on S3/GCS/HTTP
94	- CloudFormation templates: Exposed template files
95	- Docker/K8s configs: docker-compose.yml, kubernetes manifests
96	- Helm charts: values.yaml with secrets
97	- Environment files: .env files with cloud credentials
98
99	### Step 6: Cloud Metadata Pivot Paths
100
101	```bash
102	python scripts/metadata_paths.py --recon-data {recon_json}
103	```
104
105	For each web application on cloud infrastructure:
106	1. Identify potential SSRF vectors (URL parameters, PDF generators, webhooks)
107	2. Map the SSRF -> metadata -> credential chain
108	3. Assess what the IAM role/service account can access
109	4. Document the complete pivot path
110
111	### Step 7: Report Generation
112
113	```bash
114	python scripts/cloud_report.py --project {name}
115	```
116
117	Output:
118	1. Cloud infrastructure map
119	2. Accessible storage buckets with content inventory
120	3. Subdomain takeover opportunities
121	4. Serverless/container exposure
122	5. CI/CD and IaC exposure
123	6. Pivot paths from web to cloud
124	7. Prioritized remediation plan
125
126	## Error Handling
127
128	### Rate Limiting on Cloud APIs
129	1. S3 listing: Built-in exponential backoff
130	2. DNS resolution: Use multiple resolvers
131	3. If blocked: Reduce concurrency with `--threads 5`
132
133	### No Cloud Infrastructure Detected
134	If domain appears to be on-premise:
135	1. Still check for cloud storage buckets (may use S3 for backups)
136	2. Check for CI/CD exposure (GitHub Actions, etc.)
137	3. Inform

People who liked this also viewed

6 picks

Type

cloud-pivot-finder

18stars4forks

View on GitHub

How to install cloud-pivot-finder?

orizon-eu/claude-code-pentest/cloud-pivot-finder

$npx -y skills add Orizon-eu/claude-code-pentest --skill cloud-pivot-finder

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Cloud Pivot Finder
2
3	From external domains to cloud infrastructure compromise paths.
4
5	## Important
6
7	CRITICAL: Only test cloud infrastructure you have explicit authorization to test. Unauthorized access to cloud resources is a criminal offense.
8
9	## Instructions
10
11	### Step 1: Cloud Provider Detection
12
13	```bash
14	python scripts/cloud_detector.py --domain {target_domain}
15	```
16
17	Identify cloud hosting:
18	1. IP range analysis: Match IPs against AWS, GCP, Azure published IP ranges
19	2. DNS analysis: CNAME patterns (.amazonaws.com, .googleusercontent.com, *.azurewebsites.net)
20	3. Header analysis: Server headers, X-Amz-, X-GUploader-, x-ms-* headers
21	4. Certificate analysis: Issuer and SAN entries pointing to cloud services
22	5. CDN detection: CloudFront, Cloud CDN, Azure CDN distributions
23
24	Output: Map of domain -> cloud provider -> service type.
25
26	### Step 2: Storage Bucket Enumeration
27
28	```bash
29	python scripts/bucket_enum.py --domain {target_domain} --provider {aws\|gcp\|azure\|all}
30	```
31
32	Naming pattern brute-force:
33	- {domain}, {domain}-backup, {domain}-dev, {domain}-staging
34	- {company}-assets, {company}-uploads, {company}-data
35	- {project}-{env} combinations
36
37	Per-provider testing:
38	- S3: Check for public ListBucket, GetObject, PutObject
39	- GCS: Check for allUsers/allAuthenticatedUsers permissions
40	- Azure Blob: Check for public container access
41
42	For each accessible bucket:
43	1. List contents (if ListBucket allowed)
44	2. Check for sensitive files (.env, credentials, backups, database dumps)
45	3. Test write access (attempt to upload test file, delete immediately)
46	4. Check bucket policy for overly permissive configurations
47
48	### Step 3: Subdomain Takeover Detection
49
50	```bash
51	python scripts/takeover_scanner.py --subdomains {subdomain_list}
52	```
53
54	Check every subdomain's CNAME for dangling references:
55	- AWS: S3, CloudFront, Elastic Beanstalk, ELB
56	- Azure: Azure Websites, Traffic Manager, CDN, Blob
57	- GCP: Cloud Storage, App Engine, Firebase
58	- Other: Heroku, GitHub Pages, Fastly, Shopify, Zendesk, Unbounce, Surge.sh
59
60	For each dangling CNAME:
61	1. Verify the target is actually unclaimed
62	2. Determine the takeover method
63	3. Assess impact (cookie scope, same-origin policy implications)
64	4. Generate takeover PoC instructions
65
66	### Step 4: Serverless and Container Discovery
67
68	```bash
69	python scripts/serverless_finder.py --domain {target_domain}
70	```
71
72	Discover:
73	- Lambda Function URLs: {function-id}.lambda-url.{region}.on.aws
74	- API Gateway: {api-id}.execute-api.{region}.amazonaws.com
75	- Cloud Functions: {region}-{project}.cloudfunctions.net
76	- Cloud Run: *.run.app
77	- Azure Functions: {app}.azurewebsites.net/api/
78	- Container registries: ECR, GCR, ACR public images
79
80	Test each for:
81	- Unauthenticated access
82	- Error messages revealing internal details
83	- Excessive function output (debug mode)
84
85	### Step 5: CI/CD and IaC Exposure
86
87	```bash
88	python scripts/cicd_finder.py --domain {target_domain}
89	```
90
91	Search for:
92	- Exposed CI/CD: Jenkins, GitLab CI, GitHub Actions artifacts
93	- Terraform state files: .tfstate files on S3/GCS/HTTP
94	- CloudFormation templates: Exposed template files
95	- Docker/K8s configs: docker-compose.yml, kubernetes manifests
96	- Helm charts: values.yaml with secrets
97	- Environment files: .env files with cloud credentials
98
99	### Step 6: Cloud Metadata Pivot Paths
100
101	```bash
102	python scripts/metadata_paths.py --recon-data {recon_json}
103	```
104
105	For each web application on cloud infrastructure:
106	1. Identify potential SSRF vectors (URL parameters, PDF generators, webhooks)
107	2. Map the SSRF -> metadata -> credential chain
108	3. Assess what the IAM role/service account can access
109	4. Document the complete pivot path
110
111	### Step 7: Report Generation
112
113	```bash
114	python scripts/cloud_report.py --project {name}
115	```
116
117	Output:
118	1. Cloud infrastructure map
119	2. Accessible storage buckets with content inventory
120	3. Subdomain takeover opportunities
121	4. Serverless/container exposure
122	5. CI/CD and IaC exposure
123	6. Pivot paths from web to cloud
124	7. Prioritized remediation plan
125
126	## Error Handling
127
128	### Rate Limiting on Cloud APIs
129	1. S3 listing: Built-in exponential backoff
130	2. DNS resolution: Use multiple resolvers
131	3. If blocked: Reduce concurrency with `--threads 5`
132
133	### No Cloud Infrastructure Detected
134	If domain appears to be on-premise:
135	1. Still check for cloud storage buckets (may use S3 for backups)
136	2. Check for CI/CD exposure (GitHub Actions, etc.)
137	3. Inform

People who liked this also viewed

6 picks

Type