DRAFT: Implementing cloud asset discovery

cloud-enumeration/cloud-enum-aws-s3-bucket.yaml

@@ -0,0 +1,32 @@
+id: cloud-enum-aws-s3-bucket
+
+info:
+  name: Cloud Enumeration - AWS S3 Buckets
+  author: initstring
+  severity: medium
+  description: Searches for open and protected buckets in AWS S3
+  reference: tba
+  tags: cloud,aws
+
+self-contained: true
+
+variables:
+  baseDNS: "s3.amazonaws.com"
+
+requests:
+  - raw:
+      - |
+        GET http://{{keyword}}.{{baseDNS}} HTTP/1.1
+        Host: {{keyword}}.{{baseDNS}}
+    redirects: false
+    attack: batteringram
+    threads: 10
+    matchers:
+      - type: status
+        name: "Open AWS S3 Bucket"
+        status:
+          - 200
+      - type: status
+        name: "Protected AWS S3 Bucket"
+        status:
+          - 403

cloud-enumeration/cloud-enum-gcp-app-engine.yaml

@@ -0,0 +1,35 @@
+id: cloud-enum-gcp-app-engine
+
+info:
+  name: Cloud Enumeration - GCP App Engine (Appspot)
+  author: initstring
+  severity: medium
+  description: Searches for App Engine Apps in GCP
+  reference: tba
+  tags: cloud,gcp
+
+self-contained: true
+
+variables:
+  baseDNS: "appspot.com"
+  loginRedirect: "accounts.google.com"
+
+requests:
+  - raw:
+      - |
+        GET https://{{keyword}}.{{baseDNS}} HTTP/1.1
+        Host: {{keyword}}.{{baseDNS}}
+    redirects: false
+    attack: batteringram
+    threads: 10
+    matchers:
+      - type: status
+        name: "Open GCP App Engine App"
+        status:
+          - 200
+      - type: dsl
+        name: "Protected GCP App Engine App"
+        condition: and
+        dsl:
+          - "status_code==302"
+          - contains(location, "login")

cloud-enumeration/cloud-enum-gcp-bucket.yaml

@@ -0,0 +1,32 @@
+id: cloud-enum-gcp-bucket
+
+info:
+  name: Cloud Enumeration - GCP Buckets
+  author: initstring
+  severity: medium
+  description: Searches for open and protected buckets in GCP
+  reference: tba
+  tags: cloud,gcp
+
+self-contained: true
+
+variables:
+  baseDNS: "storage.googleapis.com"
+
+requests:
+  - raw:
+      - |
+        GET http://{{keyword}}.{{baseDNS}} HTTP/1.1
+        Host: {{keyword}}.{{baseDNS}}
+    redirects: false
+    attack: batteringram
+    threads: 10
+    matchers:
+      - type: status
+        name: "Open GCP Bucket"
+        status:
+          - 200
+      - type: status
+        name: "Protected GCP Bucket"
+        status:
+          - 403

cloud-enumeration/cloud-enum-gcp-firebase-app.yaml

@@ -0,0 +1,28 @@
+id: cloud-enum-gcp-firebase-app
+
+info:
+  name: Cloud Enumeration - GCP Firebase Apps
+  author: initstring
+  severity: medium
+  description: Searches for Firebase Apps in GCP
+  reference: tba
+  tags: cloud,gcp
+
+self-contained: true
+
+variables:
+  baseDNS: "firebaseapp.com"
+
+requests:
+  - raw:
+      - |
+        GET https://{{keyword}}.{{baseDNS}} HTTP/1.1
+        Host: {{keyword}}.{{baseDNS}}
+    redirects: false
+    attack: batteringram
+    threads: 10
+    matchers:
+      - type: status
+        name: "Open GCP Firebase App"
+        status:
+          - 200

cloud-enumeration/cloud-enum-gcp-firebase-rtdb.yaml

@@ -0,0 +1,40 @@
+id: cloud-enum-gcp-firebase-rtdb
+
+info:
+  name: Cloud Enumeration - GCP Firebase Realtime Database
+  author: initstring
+  severity: medium
+  description: Searches for Firebase Realtime Databases in GCP
+  reference: tba
+  tags: cloud,gcp
+
+self-contained: true
+
+variables:
+  baseDNS: "firebaseio.com"
+
+requests:
+  - raw:
+      - |
+        GET https://{{keyword}}.{{baseDNS}}/.json HTTP/1.1
+        Host: {{keyword}}.{{baseDNS}}
+    redirects: false
+    attack: batteringram
+    threads: 10
+    matchers:
+      - type: status
+        name: "Open GCP Firebase RTDB"
+        status:
+          - 200
+      - type: status
+        name: "Protected GCP Firebase RTDB"
+        status:
+          - 401
+      - type: status
+        name: "Payment GCP on Google Firebase RTDB"
+        status:
+          - 402
+      - type: status
+        name: "Deactivated GCP Firebase RTDB"
+        status:
+          - 423