Cloud asset discovery

When it applies

Recon on an org where a lot of surface lives in the cloud. Mapping the cloud footprint surfaces storage exposure, forgotten apps, and IP ranges that feed the cloud-specific skills.

Why it works

Cloud resources use predictable naming and public namespaces (S3 bucket names are global; app services use *.azurewebsites.net, *.appspot.com, etc.). Permuting the org name across providers reveals assets that aren't linked from the main site.

Method

1. Permutation sweep: cloud_enum -k <company> -k <company>-prod -k <brand> to check AWS S3, Azure blobs/apps, and GCP buckets/apps for names derived from the org.
2. From existing assets: resolve subdomains/CNAMEs (→ recon-subdomain-enum, recon-dns-analysis) for cloud endpoints (*.s3.amazonaws.com, *.blob.core.windows.net, *.cloudfront.net).
3. IP ranges / ASN: find the org's ASN and cloud IP ranges; identify origin IPs behind CDNs.
4. Storage exposure: feed discovered buckets/containers to cloud-s3-exposure (list/read/write test).
5. Certificate transparency + favicon/Shodan (→ recon-osint) to catch cloud-hosted apps.