domains / families / security / hunt-cloud-misconfig

hunt-cloud-misconfig

combined

Hunt cloud / infrastructure misconfigurations. Hunt cloud / infrastructure misconfigurations. AWS: public S3 buckets (s3:GetObject anonymous), permissive bucket policies (PutObjectAcl public-write), exposed CloudFront origin, public Lambda function URL, public RDS snapshot, IAM credentials in JS bundles, AWS metadata accessible via SSRF. GCP: public GCS buckets, exposed Cloud Run services, leaked service account JSON. Azure: public blob containers, exposed Function App. (Kubernetes/Docker exposure is owned by hunt-k8s; CI/CD pipeline attacks by hunt-cicd; post-credential IAM escalation by cloud-iam-deep.) Detection: targeted dorking, certificate transparency, JS bundle secret extraction, port scan for known service ports. Validate: actual data read / write / RCE. Use when hunting cloud-native storage and compute misconfig (S3/GCS/Blob, IMDS-via-SSRF, serverless, public managed services).

When to use

• You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.
• You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.

When not to use

• Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.
• Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.
• Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.

Skill page

Conflict

The two copies share the same core procedure (S3/GCS/Blob listing, Firebase open rules, EC2 metadata via SSRF, exposed admin panels, LocalStack verification, and CloudWatch RUM weaponization), but each contains material steps the other lacks. The uphiago copy adds a detailed RUM attack chain (Cognito get-id/get-credentials-for-identity, STS enumeration, pacu) and a truncated Chain B, plus a more detailed description of detection surfaces. The sickn33 copy adds a mandatory authorization confirmation gate, Jenkins SSO-restriction failure to Script Console RCE, and exposed RabbitMQ/AMQP default-credential probing. Because crowning one would hide the other's unique steps and the sickn33 copy imposes a safety gate the uphiago copy does not, the correct decision is combine.