domains / families / security / cloud-saas-exposure

cloud-saas-exposure

separate

Organization-grade cloud and supply-chain attack-surface discovery: S3/GCS/Azure Blob bucket discovery via observed-name mining (CNAME/cert-SAN/Wayback) and bounded two-class permutation (6 prefixes x 15 suffixes on trusted tokens, bounded target-bound expansion on subdomain stems), existence (HEAD/GET) vs public-listing confirmation, object-key triage into 9 value tiers (database dumps, credentials, IaC state, kubeconfig, VCS dirs, config, archives, PII, logs), dangling-CNAME bucket-takeover detection, and the ownership-gated severity model that stops an unattributable public bucket from becoming a false CRITICAL; the fully offline AWS-account-ID recovery from a leaked AKIA/ASIA/AROA access key (base32 decode, runnable stdlib Python, canonical test vector, AWS-documentation-example-ID screening); dependency-confusion confirmation for npm/PyPI (internal-signal classifier -- private-registry binding vs org-namespace match -- paired with a read-only public-registry 404 check and the npm…

When to use

• S3/GCS/Azure Blob bucket discovery
• dangling-CNAME bucket-takeover detection
• offline AWS-account-ID recovery from leaked keys
• dependency-confusion confirmation for npm/PyPI
• passive cloud-native/container/Kubernetes/CI fingerprinting
• object-key triage into value tiers
• ownership-gated severity model application

When not to use

• raw bucket-permutation wordlist retrieval
• cloud-native URL pattern table retrieval
• container/K8s/CI path list retrieval
• registering an unclaimed package
• submitting AWS credentials
• authenticating to a Kubernetes API
• active control-plane confirmation
• exploitation

Skill page

Source