cloud-enum

Overview

cloud_enum checks for public cloud resources across AWS, Azure, and Google Cloud by guessing common naming patterns derived from a keyword. It discovers public S3 buckets, Azure Blob containers, GCP buckets, Azure websites, and more that may expose sensitive data without authentication.

Basic Usage

Enumerate all cloud providers for a keyword

cloud_enum -k companyname

Multiple keywords

cloud_enum -k company -k company-dev -k company-prod

Keywords from file

cloud_enum -kf keywords.txt

cloud_enum -k target --disable-gcp    # AWS + Azure only

cloud_enum -k target --disable-azure  # AWS + GCP only

cloud_enum -k target --disable-aws    # Azure + GCP only

Wordlist Options

Custom mutation wordlist

cloud_enum -k company -m /usr/share/cloud_enum/enum_tools/fuzz.txt

Increase brute-force permutations

cloud_enum -k company -t 50  # 50 threads

Use a custom wordlist

cloud_enum -k company -kf mutations.txt

What It Checks

AWS:
  - S3 buckets:  https://<keyword>.s3.amazonaws.com
  - S3 URLs:     https://s3.amazonaws.com/<keyword>
  - EC2 snapshots, AMIs (via APIs)

Azure:
  - Blob storage: https://<keyword>.blob.core.windows.net
  - Static sites: https://<keyword>.azurewebsites.net
  - Table storage, Queue, Files
  - Azure CDN

GCP:
  - GCS buckets: https://storage.googleapis.com/<keyword>
  - Firebase:    https://<keyword>.firebaseio.com
  - App Engine:  https://<keyword>.appspot.com
  - GCP Functions

Output

Save output to file

cloud_enum -k company 2>&1 | tee results.txt

Verbose (show all checked URLs)

cloud_enum -k company -v

# Sample output:
# [+] Found open S3 bucket: company-backup.s3.amazonaws.com
# [+] Found Azure blob: company.blob.core.windows.net/backups
# [+] Found GCS bucket: gs://company-logs

Follow-Up After Finding Resources

Check S3 bucket contents

aws s3 ls s3://company-backup --no-sign-request

Download all files from public bucket

aws s3 sync s3://company-backup . --no-sign-request

Check Azure blob container

az storage blob list --account-name company --container-name backups --auth-mode anonymous

# Check GCS bucket
gsutil ls gs://company-logs
gsutil cp -r gs://company-logs .

Generating Keywords

# Create keyword list from company name
COMPANY="targetcorp"
echo -e "${COMPANY}\n${COMPANY}-dev\n${COMPANY}-staging\n${COMPANY}-prod\n${COMPANY}-backup\n${COMPANY}dev\n${COMPANY}backup" > keywords.txt

cloud_enum -kf keywords.txt

Tips

• Start with the company’s primary domain name (without TLD) as the keyword
• Also try abbreviations, product names, and common environment suffixes (-dev, -prod, -test)
• Check for .git repos and database dumps in discovered buckets
• Always test with --no-sign-request for truly public access

cloud_enum [options]

-k KEYWORD        Keyword to search for
-kf FILE          Keywords from file
-m FILE           Mutations wordlist
-t THREADS        Threads (default: 5)
-l LOGFILE        Log results to file
-v                Verbose mode
--disable-aws     Skip AWS checks
--disable-azure   Skip Azure checks
--disable-gcp     Skip GCP checks

Vue d’ensemble

cloud_enum recherche les ressources cloud publiques sur AWS, Azure et Google Cloud en devinant les motifs de nommage courants dérivés d’un mot-clé. Il découvre les buckets S3 publics, les conteneurs Azure Blob, les buckets GCP, les sites Azure, et plus, qui peuvent exposer des données sensibles sans authentification.

Utilisation de base

# Énumérer tous les fournisseurs cloud pour un mot-clé
cloud_enum -k companyname

# Plusieurs mots-clés
cloud_enum -k company -k company-dev -k company-prod

# Mots-clés depuis un fichier
cloud_enum -kf keywords.txt

cloud_enum -k target --disable-gcp    # AWS + Azure uniquement
cloud_enum -k target --disable-azure  # AWS + GCP uniquement
cloud_enum -k target --disable-aws    # Azure + GCP uniquement

Options de wordlist

# Wordlist de mutations personnalisée
cloud_enum -k company -m /usr/share/cloud_enum/enum_tools/fuzz.txt

# Augmenter les permutations de brute-force
cloud_enum -k company -t 50  # 50 threads

# Utiliser une wordlist personnalisée
cloud_enum -k company -kf mutations.txt

Ce qu’il vérifie

AWS :
  - Buckets S3 :  https://<keyword>.s3.amazonaws.com
  - URLs S3 :     https://s3.amazonaws.com/<keyword>
  - Snapshots EC2, AMIs (via les APIs)

Azure :
  - Stockage Blob : https://<keyword>.blob.core.windows.net
  - Sites statiques : https://<keyword>.azurewebsites.net
  - Table storage, Queue, Files
  - Azure CDN

GCP :
  - Buckets GCS : https://storage.googleapis.com/<keyword>
  - Firebase :    https://<keyword>.firebaseio.com
  - App Engine :  https://<keyword>.appspot.com
  - GCP Functions

Sortie

# Sauvegarder la sortie dans un fichier
cloud_enum -k company 2>&1 | tee results.txt

# Verbeux (afficher toutes les URLs vérifiées)
cloud_enum -k company -v

# Exemple de sortie :
# [+] Found open S3 bucket: company-backup.s3.amazonaws.com
# [+] Found Azure blob: company.blob.core.windows.net/backups
# [+] Found GCS bucket: gs://company-logs

Suite après avoir trouvé des ressources

# Vérifier le contenu d'un bucket S3
aws s3 ls s3://company-backup --no-sign-request

# Télécharger tous les fichiers d'un bucket public
aws s3 sync s3://company-backup . --no-sign-request

# Vérifier un conteneur Azure blob
az storage blob list --account-name company --container-name backups --auth-mode anonymous

# Vérifier un bucket GCS
gsutil ls gs://company-logs
gsutil cp -r gs://company-logs .

Générer des mots-clés

# Créer une liste de mots-clés à partir du nom de l'entreprise
COMPANY="targetcorp"
echo -e "${COMPANY}\n${COMPANY}-dev\n${COMPANY}-staging\n${COMPANY}-prod\n${COMPANY}-backup\n${COMPANY}dev\n${COMPANY}backup" > keywords.txt

cloud_enum -kf keywords.txt

Conseils

• Commencez par le nom de domaine principal de l’entreprise (sans le TLD) comme mot-clé
• Essayez aussi les abréviations, noms de produits et suffixes d’environnement courants (-dev, -prod, -test)
• Cherchez des repos .git et des dumps de base de données dans les buckets découverts
• Testez toujours avec --no-sign-request pour un accès vraiment public

cloud_enum [options]

-k KEYWORD        Keyword to search for
-kf FILE          Keywords from file
-m FILE           Mutations wordlist
-t THREADS        Threads (default: 5)
-l LOGFILE        Log results to file
-v                Verbose mode
--disable-aws     Skip AWS checks
--disable-azure   Skip Azure checks
--disable-gcp     Skip GCP checks