Skip to content
HackIndex logo

HackIndex

AWS Asset Exposure Mapping

3 min read May 24, 2026

Identify what the target exposes to the internet before scanning. AWS infrastructure has recognizable fingerprints — cloud metadata headers, EC2 instance metadata endpoints, and predictable DNS patterns.

Shodan

Search for EC2 instances and services by organization or IP range. AWS IP ranges are published and Shodan indexes them continuously.

Search by organization:

org:"Amazon" hostname:"$DOMAIN"
org:"Amazon" html:"$COMPANY"

Search for specific services on AWS IP space:

org:"Amazon" port:8080 http.title:"$COMPANY"
org:"Amazon" port:443 ssl.cert.subject.cn:"$DOMAIN"

Search for exposed management interfaces:

org:"Amazon" port:8443 title:"admin"
org:"Amazon" port:9200 product:"Elasticsearch"
org:"Amazon" port:6379 product:"Redis"

The Shodan CLI:

┌──(kali㉿kali)-[~]
└─$ pipx install shodan
┌──(kali㉿kali)-[~]
└─$ shodan init $SHODAN_API_KEY
┌──(kali㉿kali)-[~]
└─$ shodan search 'org:"Amazon" hostname:"$DOMAIN"' --fields ip_str,port,hostnames,org

CloudFront Origin Discovery

CloudFront distributions sit in front of origins — EC2 instances, S3 buckets, ALBs, or custom servers. The origin IP is often reachable directly if security groups allow it, bypassing WAF and CloudFront restrictions.

Discover the origin IP via:

SSL certificate history (Censys):

┌──(kali㉿kali)-[~]
└─$ pip install censys
┌──(kali㉿kali)-[~]
└─$ censys search "parsed.names: $DOMAIN" --index-type certificates | jq '.[] | .parsed.subject_dn'

Direct IP probe bypassing CloudFront:

┌──(kali㉿kali)-[~]
└─$ curl -sk -H "Host: $DOMAIN" https://$TARGET_IP/ -o /dev/null -w "%{http_code}"
Explain command
-H "Host: $DOMAIN" Send the original domain as Host header so the origin recognises the request.

A 200 response on the direct IP confirms the origin is accessible without CloudFront.

Public AMI Enumeration

AMIs marked public by mistake or for distribution often contain sensitive data — credentials in user data, hardcoded keys in scripts, or internal tooling.

Search for public AMIs owned by the target account (if you have their account ID from recon):

┌──(kali㉿kali)-[~]
└─$ aws ec2 describe-images --owners $ACCOUNT_ID --no-sign-request --region us-east-1
┌──(kali㉿kali)-[~]
└─$ aws ec2 describe-images --filters "Name=name,Values=*$COMPANY*" "Name=is-public,Values=true" --no-sign-request --region us-east-1

For each found AMI, the description, name, and tags often reveal environment names, application versions, and internal naming conventions.

AWS IP Range Lookup

AWS publishes all IP ranges at https://ip-ranges.amazonaws.com/ip-ranges.json. Cross-reference discovered IPs to confirm what is running on AWS and in which region.

┌──(kali㉿kali)-[~]
└─$ curl -s https://ip-ranges.amazonaws.com/ip-ranges.json | python3 -c "
import json, sys, ipaddress
data = json.load(sys.stdin)
target = '$TARGET_IP'
for p in data['prefixes']:
try:
if ipaddress.ip_address(target) in ipaddress.ip_network(p['ip_prefix']):
print(p)
except:
pass
"

Knowing the region narrows your scan scope and informs which regional API endpoints to target.

HTTP Response Fingerprinting

AWS services return identifiable headers. Passive scanning of known domains can confirm AWS-hosted infrastructure:

┌──(kali㉿kali)-[~]
└─$ curl -sI https://$DOMAIN | grep -i "x-amz\|cloudfront\|AmazonS3" 
x-amz-request-id: ABC123
x-amz-cf-id: XYZ789
x-cache: Hit from cloudfront

These headers confirm AWS hosting without any active scanning and identify whether CloudFront is in the path.