cloud_osint - ☁️ Curated Cloud OSINT resources — dorks, tools, a

项目说明

<p align="center">
<img src="assets/cloud-osint-banner.jpg" alt="Cloud OSINT - Uncover the Unseen" width="600">
</p>

<p align="center">
<strong>The Definiti OSINT Resource - Uncover the Unseen</strong>
</p>

<p align="center">
<a href=" src=" alt="Awesome"></a>
<img src=" alt="Stars">
<img src=" alt="Forks">
<img src=" alt="Last Commit">
<img src=" alt="License">
<img src=" alt="Contributors">
<img src=" alt="Cloud Pro">
</p>

<p align="center">
_{Curated collection of OSINT resources for cloud infrastructure reconnaissance.<br>
Includes dorks, tools, techniques, and methodologies for AWS, Azure, GCP, Oracle Cloud, IBM Cloud, and more.<br>
Built for security professionals, red teamers, bug bounty hunters, and cloud architects.}
</p>

<p align="center">
If you find this useful, please ⭐ <strong>star this repo</strong> — it helps others discover it!
</p>

---

📖 Contents

🗺️ Cloud OSINT Methodology

☁️ Cloud Infrastructure Patterns

- 🔵 Azure Storage
- 🟠 AWS Regions
- 🟠 AWS S3 Buckets
- 🟠 AWS SQS
- 🔴 GCP Technologies
- ⚫ IBM Cloud
- 🟤 Oracle Cloud
- 📡 Official IP Range Sources

🔍 Google Dorks

- Azure Dorks
- AWS Dorks
- Google Cloud Dorks
- IBM Cloud Dorks
- Miscellaneous Dorks

🌐 Shodan Dorks

- Filter Reference
- Azure Queries
- Amazon Queries
- Other Cloud Queries

🔐 Certificate Transparency

📚 Web Cloud OSINT Resources

🛠️ Cloud OSINT Tools

- Multi-Cloud Tools
- AWS-Specific Tools
- Azure-Specific Tools
- GCP-Specific Tools
- Bucket and Storage Discovery

🌍 Domain and Subdomain Identification

📝 Dork Generation Tools

📦 Additional Resources

⚖️ Responsible Use

🤝 Contributing

---

🗺️ Cloud OSINT Methodology

> Cloud OSINT follows a structured reconnaissance workflow. Use this framework to map resources to your in phase.

| Phase | Techniques | Tools and Resources |
|-------|-----------|-------------------|
| 🔍 Passi | Google dorks, Shodan queries, DNS lookups, Certificate Transparency | DorkSearch, Shodan, crt.sh, Censys |
| 📡 Infrastructure Mapping | IP range analysis, cloud provider identification, region mapping | AWS ip-ranges.json, Azure IP ranges, BGP lookups |
| 🗂️ Asset Discovery | Bucket enumeration, subdomain discovery, storage scanning | CloudEnum, cloud_enum, S3Scanner, GrayhatWarfare |
| 🔓 Exposure Analysis | Misconfiguration detection, sensitive data search, access testing | S3Browser, BucketLoot, ScoutSuite, Prowler |
| 📊 Reporting | Findings consolidation, e collection, risk assessment | Manual analysis + tool outputs |

↑ Back to Contents

---

☁️ Cloud Infrastructure Patterns

> Understanding cloud URL patterns, regions, and service endpoints is the foundation of Cloud OSINT.

🔵 Azure Storage

| Service | URL Pattern |
|---------|-------------|
| Blob Storage | |
| Table Storage | |
| Queue Storage | |
| Azure Files | |
| Database | |

🟠 AWS Regions

<details>
<summary>Click to expand full AWS regions list (36 regions)</summary>

| Region Code | Location |
|-------------|----------|
| af-south-1 | Africa (Cape Town) |
| ap-east-1 | Asia Pacific (Hong Kong) |
| ap-northeast-1 | Asia Pacific (Tokyo) |
| ap-northeast-2 | Asia Pacific (Seoul) |
| ap-northeast-3 | Asia Pacific (Osaka) |
| ap-south-1 | Asia Pacific (Mumbai) |
| ap-south-2 | Asia Pacific (Hyderabad) |
| ap-southeast-1 | Asia Pacific (Singapore) |
| ap-southeast-2 | Asia Pacific (Sydney) |
| ap-southeast-3 | Asia Pacific (Jakarta) |
| ap-southeast-4 | Asia Pacific (Melbourne) |
| ap-southeast-5 | Asia Pacific (Malaysia) |
| ap-southeast-7 | Asia Pacific (Thailand) |
| ca-central-1 | Canada (Central) |
| ca-west-1 | Canada (Calgary) |
| cn-north-1 | China (Beijing) |
| cn-northwest-1 | China (Ningxia) |
| eu-central-1 | Europe (Frankfurt) |
| eu-central-2 | Europe (Zurich) |
| eu-north-1 | Europe (Stockholm) |
| eu-south-1 | Europe (Milan) |
| eu-south-2 | Europe (Spain) |
| eu-west-1 | Europe (Ireland) |
| eu-west-2 | Europe (London) |
| eu-west-3 | Europe (Paris) |
| il-central-1 | Israel (Tel Aviv) |
| me-central-1 | Middle East (UAE) |
| me-south-1 | Middle East (Bahrain) |
| mx-central-1 | Mexico (Central) |
| sa-east-1 | South America (Sao Paulo) |
| us-east-1 | US East (N. ) |
| us-east-2 | US East (Ohio) |
| us-go | AWS Go (US-East) |
| us-go | AWS Go (US-West) |
| us-west-1 | US West (N. California) |
| us-west-2 | US West (Oregon) |

</details>

🟠 AWS S3 Buckets

| Pattern | URL Format |
|---------|------------|
| Path style | ] |
| hosted | ].s3.amazonaws.com |
| Region specific | ].amazonaws.com/[bucketname]/ |
| Website hosting | ].s3-website-[region].amazonaws.com/ |

🟠 AWS SQS

🔴 GCP Technologies

GCP Technologies Cheatsheet - o of all Google Cloud services and their relationships.

GCP Regions and Zones - Complete list of GCP datacenter locations worldwide.

⚫ IBM Cloud

IBM Global Cloud Data Centers - Map and list of all IBM Cloud datacenter locations.

IBM Cloud IP Ranges - Official IP address ranges for IBM Cloud infrastructure.

🟤 Oracle Cloud

Oracle Cloud Regions - All Oracle Cloud Infrastructure (OCI) region locations.

Oracle Cloud IP Ranges - Official OCI IP address ranges documentation.

📡 Official IP Range Sources

> Direct links to query cloud provider IP ranges programmatically.

| Provider | Source | Quick Query |
|----------|--------|-------------|
| AWS | ip-ranges.json | curl -s \| jq '.prefixes[]' |
| Azure | Ser | Download weekly JSON from Microsoft Download Center |
| GCP | cloud.json | curl -s \| jq '.prefixes[]' |
| Oracle | public_ip_ranges.json | curl -s |

↑ Back to Contents

---

🔍 Google Dorks

> Search engine queries crafted to disco cloud assets, misconfigurations, and sensitive data across major cloud pro.

Azure Dorks

> 💡 Azure SAS Tokens: Search for "bfqt&srt" to find exposed Shared Access Signature tokens.

AWS Dorks

Google Cloud Dorks

IBM Cloud Dorks

Miscellaneous Dorks

↑ Back to Contents

---

🌐 Shodan Dorks

> Shodan queries to disco services, misconfigurations, and exposed infrastructure.

Filter Reference

| Filter | Description |
|--------|-------------|
| cloud.provider | Filter by cloud provider name (Amazon, Azure, Google, etc.) |
| cloud.region | Filter by cloud region identifier |
| cloud.service | Filter by specific cloud service name |

Azure Queries

Amazon Queries

Other Cloud Queries

↑ Back to Contents

---

🔐 Certificate Transparency

> Certificate Transparency (CT) logs record every SSL/TLS certificate issued, making them a goldmine for disco cloud-hosted assets and subdomains.

crt.sh - Search CT logs by domain, organization, or certificate fingerprint. Use example.com to find all subdomains.

Censys Certificates - Ad certificate search with filters for cloud provider organizations.

CertStream - Real-time certificate issuance monitoring to detect new cloud deployments as they go live.

Facebook CT Monitor - Monitor certificates issued for specific domains.

Example CT queries for cloud assets:

↑ Back to Contents

---

📚 Web Cloud OSINT Resources

> Online platforms and search engines for disco exposed cloud assets and misconfigurations.

GrayhatWarfare - Search engine for open S3 buckets, Azure blobs, and GCP storage across cloud pro.

Google Custom Search for Cloud Storage - Custom Google search engine focused on cloud storage buckets and containers.

FullHunt - Attack surface discovery platform with cloud asset identification capabilities.

AADInternals OSINT - Azure Acti tenant information including subdomains and configuration data.

SOCRadar BlueBleed - Disco servers containing sensitive data across Azure, AWS, and GCP storage.

Forager by TruffleSecurity - Explore exposed cloud and service keys/credentials found in public sources.

AWS Eye - OSINT tool for in AWS configurations, identifying misconfigured S3 buckets, and unco cloud exposures.

LeakIX - Search engine for exposed services and data leaks, with cloud infrastructure filters.

PublicWWW - Source code search engine useful for finding websites connected to specific cloud services.

> 💡 Tip: Use the GrayhatWarfare API to programmatically search for exposed files:
>

↑ Back to Contents

---

🛠️ Cloud OSINT Tools

> Curated collection of tools for cloud reconnaissance, enumeration, and security assessment. Organized by scope and cloud provider.

Multi-Cloud Tools

CloudEnum - Multi-cloud OSINT tool that enumerates public resources across AWS, Azure, and GCP simultaneously.

CloudBrute - Cloud infrastructure discovery tool supporting multiple pro with concurrent enumeration.

CloudFox - Automating situational awareness for cloud penetration testing across AWS, Azure, and GCP.

CloudSploit - Cloud security posture management detecting misconfigurations across AWS, Azure, GCP, and Oracle.

Cartography - Consolidates infrastructure assets and relationships across cloud pro into a graph database.

Prowler - Open-source cloud security tool for AWS, Azure, GCP, and Kubernetes with 300+ checks.

ScoutSuite - Multi-cloud security auditing tool for AWS, Azure, GCP, Alibaba Cloud, and Oracle Cloud configurations.

Steampipe - Query cloud infrastructure using SQL across AWS, Azure, GCP, and 100+ other services.

AWS-Specific Tools

AWSBucketDump - Quickly enumerate AWS S3 buckets and search for interesting files within discovered buckets.

enumerate-iam - Enumerate IAM permissions for a given set of AWS credentials without logging.

lazys3 - Brute-force AWS S3 bucket discovery using different permutations of common names.

Pacu - AWS exploitation framework designed for offensi testing of cloud en.

S3Scanner - Scan for open S3 buckets, dump their contents, and check bucket permissions.

WeirdAAL - AWS Attack Library for testing and AWS security configurations.

Azure-Specific Tools

AADInternals - PowerShell module for Azure AD and Office 365 administration, exploitation, and backdooring.

MicroBurst - PowerShell toolkit for attacking Azure services including storage, key , and more.

ROADtools - Framework for Azure AD reconnaissance and exploration of directory data.

Stormspotter - Azure AD and resource tool for mapping attack paths.

GCP-Specific Tools

GCPBucketBrute - Enumerate Google Storage buckets, determine access permissions, and check pri escalation.

gcp_enum - GCP enumeration tool for disco and auditing Google Cloud resources.

Hayat - GCP resource enumeration and analysis tool for security assessments.

Bucket and Storage Discovery

bucket_finder - Tool to bruteforce for the existence of AWS S3 buckets and check permissions.

BucketLoot - Automated tool to inspect exposed storage buckets for sensitive data across cloud pro.

S3 Browser - Windows client for Amazon S3 and CloudFront, useful for browsing discovered bucket contents.

↑ Back to Contents

---

🌍 Domain and Subdomain Identification

> Tools and services for disco domains, subdomains, and cloud-associated hostnames.

Censys Search - Search engine for hosts, domains, SSL certificates, and cloud-associated infrastructure.

crt.sh - Find domains and subdomains through SSL certificate transparency logs.

DNSDumpster - Domain research tool for DNS recon and disco hosts related to a target domain.

osint.sh DNS History - Historical DNS record lookup to track infrastructure changes over time.

osint.sh Subdomain Finder - Subdomain enumeration through multiple data sources.

SecurityTrails - Historical DNS data and domain intelligence with API access for automation.

Spyse - Domain and subdomain enumeration with detailed DNS intelligence.

Subfinder - Fast passi enumeration tool using multiple online sources.

ZoomEye - Cyberspace search engine for disco internet-connected devices and exposed services.

↑ Back to Contents

---

📝 Dork Generation Tools

> Tools to help craft and optimize search engine dorks for cloud OSINT in.

DorkSearch - dork builder with pre-built templates for common cloud searches.

DorkGPT - AI-powered Google dork generator using ChatGPT for custom query creation.

Google Hacking Database (GHDB) - Extensi of Google dork queries categorized by target type.

↑ Back to Contents

---

📦 Additional Resources

> Complementary tools and platforms that enhance Cloud OSINT workflows.

Dedigger - Find exposed files in Google Dri search terms like AWS, Azure, GCP, etc.

httpx - Fast HTTP toolkit useful for probing discovered cloud endpoints at scale.

IntelX - Intelligence search engine indexing historical data from cloud services, paste sites, and data leaks.

Nuclei - scanner with cloud-specific templates for detecting misconfigurations.

↑ Back to Contents

---

⚖️ Responsible Use

> ⚠️ Important: The resources in this repository are intended for authorized security testing, educational purposes, and legitimate research only.

Cloud OSINT techniques can reveal sensiti about organizations' cloud infrastructure. Users of this repository are expected to:

Obtain proper authorization before conducting any reconnaissance against cloud infrastructure you do not own.

Follow applicable laws including the Computer Fraud and Abuse Act (CFAA), GDPR, and equi regulations in your jurisdiction.

Practice responsible disclosure if you disco data or misconfigurations belonging to third parties.

Respect privacy and avoid accessing, downloading, or distributing sensitive data found through these techniques.

Neither the maintainers of this repository nor 7Way Security are responsible for any misuse of the information provided herein.

↑ Back to Contents

---

🤝 Contributing

Contributions are welcome and appreciated! Please read our Contributing Guidelines before submitting a PR.

Quick contribution guide:

1. Fork this repository
2. Add your resource following the format: - Tool Name - Brief description of what it does.
3. Ensure your addition is placed in the correct category
4. Submit a Pull Request

See CONTRIBUTING.md for detailed instructions.

---

🤖 AI OSINT

Looking for OSINT resources specific to AI/ML infrastructure? Check out our companion repository:

ai_osint — Google dorks, Shodan queries, and techniques to disco LLM endpoints (Ollama, vLLM), leaked AI API keys (OpenAI, Anthropic, Gemini), misconfigured databases (Qdrant, Weaviate, ChromaDB), unprotected AI agents (MCP servers, OpenClaw), and more.

---

<p align="center">
<sub>Maintained with ❤️ by <a href=" Security</a> | <a href="
</p>

项目信息

开发语言：未知

Star 数：141

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕☁️ Curated Cloud OSINT resources — dorks, tools, and techniques for AWS, Azure, GCP, Oracle Cloud, and other major providers reconnaissance展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。