Skip to content
HackIndex logo

HackIndex

Route53 and CloudFront Enumeration

2 min read May 24, 2026

Route53

List Hosted Zones

┌──(kali㉿kali)-[~]
└─$ aws route53 list-hosted-zones --profile $PROFILE --query 'HostedZones[*].{ID:Id,Name:Name,Private:Config.PrivateZone,Records:ResourceRecordSetCount}' --output table

Private zones are only resolvable within the associated VPC — they expose internal hostnames.

List All DNS Records

┌──(kali㉿kali)-[~]
└─$ ZONE_ID=$(aws route53 list-hosted-zones --profile $PROFILE | jq -r '.HostedZones[] | select(.Name=="$DOMAIN.") | .Id' | cut -d'/' -f3)
┌──(kali㉿kali)-[~]
└─$ aws route53 list-resource-record-sets --hosted-zone-id $ZONE_ID --profile $PROFILE --query 'ResourceRecordSets[*].{Name:Name,Type:Type,TTL:TTL,Value:ResourceRecords[0].Value}' --output table

CNAME records pointing to AWS services (S3, Elastic Beanstalk, CloudFront) may be dangling takeover candidates. See S3 Bucket Discovery.

Private Zone Records

Private zones reveal internal service names, database hostnames, internal load balancers, and microservice endpoints:

┌──(kali㉿kali)-[~]
└─$ aws route53 list-resource-record-sets --hosted-zone-id $ZONE_ID --profile $PROFILE | jq '.ResourceRecordSets[] | select(.Type == "A" or .Type == "CNAME")'

Health Checks

Route53 health checks reveal which endpoints are being monitored and their status:

┌──(kali㉿kali)-[~]
└─$ aws route53 list-health-checks --profile $PROFILE --query 'HealthChecks[*].{ID:Id,Type:HealthCheckConfig.Type,Target:HealthCheckConfig.FullyQualifiedDomainName,Port:HealthCheckConfig.Port}' --output table

CloudFront

List Distributions

┌──(kali㉿kali)-[~]
└─$ aws cloudfront list-distributions --profile $PROFILE --query 'DistributionList.Items[*].{ID:Id,Domain:DomainName,Origins:Origins.Items[0].DomainName,Enabled:Enabled,Status:Status}' --output table

Get Distribution Config

Full config including origins, behaviours, WAF associations, and geo-restrictions:

┌──(kali㉿kali)-[~]
└─$ aws cloudfront get-distribution --id $DISTRIBUTION_ID --profile $PROFILE

Origin domain names may reveal:

  • S3 bucket names (potential public access if misconfigured)

  • Internal ALB DNS names (reachable directly if security groups allow it)

  • EC2 instance public DNS

Origin Access Control / Identity

Check if S3 origins are protected by an OAC or OAI (restricts direct S3 access):

┌──(kali㉿kali)-[~]
└─$ aws cloudfront get-distribution --id $DISTRIBUTION_ID --profile $PROFILE | jq '.Distribution.DistributionConfig.Origins.Items[] | {Domain:.DomainName, OAC:.OriginAccessControlId, OAI:.S3OriginConfig.OriginAccessIdentity}'

If OriginAccessIdentity is empty and the S3 bucket has no separate restriction, the bucket may be accessible directly.

Cache Policies and Functions

┌──(kali㉿kali)-[~]
└─$ aws cloudfront list-cache-policies --profile $PROFILE
┌──(kali㉿kali)-[~]
└─$ aws cloudfront list-functions --profile $PROFILE
┌──(kali㉿kali)-[~]
└─$ aws cloudfront get-function --name $FUNCTION_NAME --profile $PROFILE

CloudFront Functions run at the edge and may contain business logic, auth checks, or token validation — worth reviewing for bypasses.