Cloud Infrastructure OSINT Tools
Discover exposed cloud assets, identify public S3 buckets, unsecured instances and leaked secrets. These tools are essential for attack surface auditing and cloud security.
20 tools · Version française
- AADInternals (T)also written AADInternals, AAD InternalsPowerShell toolkit for Azure AD and Entra ID assessment, including tenant reconnaissance and hybrid identity attack-path analysis.free
- Amass (T)also written AmassAdvanced attack surface mapping framework for DNS and subdomain enumeration with graph correlation and extensive data-source support.free
- AWSBucketDump (T)also written AWSBucketDump, AWS Bucket DumpPython tool that enumerates AWS S3 buckets and optionally downloads accessible objects using keyword and pattern-based discovery.free
- BucketLoot (T)also written BucketLoot, Bucket LootOpen-source cloud bucket discovery utility with limited current documentation and unclear maintenance signals.free
- Checkov (T)also written CheckovInfrastructure-as-code security scanner that checks Terraform, CloudFormation, Kubernetes, and other cloud configs against policy rules.free
- Cloud Custodian (T)also written Cloud Custodian, CloudCustodianPolicy-as-code engine for cloud governance and security that can detect and remediate risky cloud configurations.free
- cloud_enum (T)also written cloud_enum, cloud enumMulti-cloud enumeration tool that looks for exposed AWS, Azure, and GCP storage assets from target naming patterns.free
- GCPBucketBrute (T)also written GCPBucketBrute, GCP Bucket BruteGoogle Cloud Storage bucket enumeration utility for identifying publicly accessible or weakly protected buckets.free
- goblob (T)also written goblobGo-based Azure blob storage enumeration utility designed for fast discovery of publicly exposed containers and blobs.free
- lazys3 (T)also written lazys3S3 bucket brute-forcing utility that generates candidate names from permutations and checks bucket accessibility.free
- MicroBurst (T)also written MicroBurst, Micro BurstPowerShell collection focused on Azure security assessment, including subscription discovery and cloud service misconfiguration checks.free
- Prowler (T)also written ProwlerCloud security posture and compliance assessment framework covering AWS, Azure, GCP, Kubernetes, and SaaS surfaces.freemium
- Public Bucketsalso written PublicBucketsSearch interface for publicly indexed cloud object storage buckets and files across multiple providers.freemium
- ROADtools (T)also written ROADtools, ROA DtoolsAzure AD exploration framework for dumping tenant objects, principals, and permissions to support attack-path and privilege analysis.free
- S3Scanner (T)also written S3Scanner, S3 ScannerCommand-line scanner for enumerating and checking S3 bucket misconfigurations across AWS and compatible object storage services.free
- ScoutSuite (T)also written ScoutSuite, Scout SuiteMulti-cloud auditing tool that inventories cloud resources and highlights security risks in an interactive HTML report.free
- SpiderFoot (T)also written SpiderFoot, Spider FootAutomated OSINT collection tool with 200+ modules for reconnaissance and threat intelligence.free
- Steampipe (T)also written SteampipeSQL interface over cloud APIs and services, enabling ad hoc querying of AWS, Azure, GCP, and many other data sources.freemium
- Stormspotter (T)also written StormspotterGraph-based Azure reconnaissance platform that maps cloud attack paths and trust relationships using Neo4j-backed visualization.free
- Subfinder (T)also written SubfinderFast passive subdomain discovery utility that aggregates results from many curated OSINT and API-backed sources.free
Frequently asked
- How to find misconfigured S3 buckets?
- Tools like GrayhatWarfare or BucketFinder scan public AWS S3 buckets and can reveal unintentionally exposed data.
- What is attack surface management?
- It's the practice of inventorying and monitoring all exposed assets of an organization: domains, APIs, cloud instances, open ports, certificates.