AWS:
Reconnaissance
AWS recon covering S3, IAM, CloudFront, and asset exposure mapping
AWS Account ID and IAM Discovery
Techniques for enumerating AWS Account IDs and IAM principals using unauthenticated and authenticated methods to map cloud identity attack surface.
AWS Asset Exposure Mapping
Identify and enumerate publicly exposed AWS assets including S3 buckets, EC2 instances, APIs, and misconfigured IAM policies to map an organisation's attack surface.
Route53 and CloudFront Reconnaissance
Enumerate AWS Route53 DNS records and CloudFront distributions to map target infrastructure, identify origins, uncover misconfigurations, and expose hidden endpoints.
S3 Bucket Discovery
Techniques for discovering exposed AWS S3 buckets through permutation, DNS enumeration, and metadata analysis to identify misconfigured storage assets.
AWS reconnaissance collects publicly available information about the target's cloud footprint without authenticating to their account. This includes S3 bucket discovery, exposed API endpoints, DNS enumeration, and certificate transparency log analysis.
Public S3 buckets are found through predictable naming patterns, Google dorks, and dedicated tools like cloud_enum. Certificate transparency logs reveal hostnames pointing to AWS services. DNS records expose CloudFront distributions, Elastic Beanstalk environments, API Gateway endpoints, and S3 website hosting configurations that may be vulnerable to subdomain takeover.