CloudBrute
CloudBrute is an awesome cloud enumerator that finds company infrastructure, files, and apps on major cloud providers like Amazon, Google, Microsoft, DigitalOcean, Alibaba, Vultr, and Linode. It is useful for bug bounty hunters, red teamers, and penetration testers.
Description
CloudBrute is a tool designed to enumerate cloud infrastructure associated with a target company across top cloud providers. It discovers storage, apps, and other resources without authentication, making it ideal for reconnaissance phases of bug bounty hunting, red teaming, and penetration testing.
The tool supports black-box enumeration, operates quickly with concurrency, and is modular for easy customization. It works cross-platform on Windows, Linux, and macOS, with features like user-agent randomization and proxy support to evade detection.
Key supported providers include Microsoft (Storage, Apps), Amazon (Storage, Apps), Google (Storage, Apps), DigitalOcean (Storage), Vultr (Storage), Linode (Storage), and Alibaba (Storage). A complete writeup is available at https://0xsha.io/posts/introducing-cloudbrute-wild-hunt-on-the-clouds.
How It Works
CloudBrute performs cloud detection using IPINFO API and source code analysis. It generates URLs based on a domain, keyword, and wordlist, then concurrently probes them against specified cloud providers using randomized user-agents and proxies (HTTP, Socks5). It supports forced cloud searches, threading for speed, timeouts, and outputs results for manual review.
Installation
sudo apt install cloudbruteFlags
Examples
cloudbrute -hcloudbrute -d example.com -k storage -w /path/to/wordlist.txtcloudbrute -d example.com -k apps -w /path/to/wordlist.txt -c amazoncloudbrute -d example.com -k storage -w /path/to/wordlist.txt -t 100 -T 15cloudbrute -d example.com -k files -w /path/to/wordlist.txt -p /path/to/proxies.txt -a truecloudbrute -d example.com -k storage -w /path/to/wordlist.txt -o results.txt -Dcloudbrute -d example.com -k apps -w /path/to/wordlist.txt -c microsoft -q