AWS:

Reconnaissance

AWS recon covering S3, IAM, CloudFront, and asset exposure mapping

4 guides • Created May 24, 2026 • Updated May 24, 2026

4 guides

AWS Account ID and IAM Discovery

Techniques for enumerating AWS Account IDs and IAM principals using unauthenticated and authenticated methods to map cloud identity attack surface.

May 24, 2026 • 3 min read

AWS Asset Exposure Mapping

Identify and enumerate publicly exposed AWS assets including S3 buckets, EC2 instances, APIs, and misconfigured IAM policies to map an organisation's attack surface.

May 24, 2026 • 3 min read

Route53 and CloudFront Reconnaissance

Enumerate AWS Route53 DNS records and CloudFront distributions to map target infrastructure, identify origins, uncover misconfigurations, and expose hidden endpoints.

May 24, 2026 • 5 min read

S3 Bucket Discovery

Techniques for discovering exposed AWS S3 buckets through permutation, DNS enumeration, and metadata analysis to identify misconfigured storage assets.

May 24, 2026 • 1 min read

AWS reconnaissance collects publicly available information about the target's cloud footprint without authenticating to their account. This includes S3 bucket discovery, exposed API endpoints, DNS enumeration, and certificate transparency log analysis.

Public S3 buckets are found through predictable naming patterns, Google dorks, and dedicated tools like cloud_enum. Certificate transparency logs reveal hostnames pointing to AWS services. DNS records expose CloudFront distributions, Elastic Beanstalk environments, API Gateway endpoints, and S3 website hosting configurations that may be vulnerable to subdomain takeover.