A instrument to discover a firm (goal) infrastructure, recordsdata, and apps on the highest cloud suppliers (Amazon, Google, Microsoft, DigitalOcean, Alibaba, Vultr, Linode). The result is beneficial for bug bounty hunters, pink teamers, and penetration testers alike.
The entire writeup is obtainable. right here
Motivation
we’re all the time pondering of one thing we will automate to make black-box safety testing simpler. We mentioned this concept of making a a number of platform cloud brute-force hunter.primarily to seek out open buckets, apps, and databases hosted on the clouds and presumably app behind proxy servers.
Right here is the listing points on earlier approaches we tried to repair:
- separated wordlists
- lack of correct concurrency
- lack of supporting all main cloud suppliers
- require authentication or keys or cloud CLI entry
- outdated endpoints and areas
- Incorrect file storage detection
- lack help for proxies (helpful for bypassing area restrictions)
- lack help for consumer agent randomization (helpful for bypassing uncommon restrictions)
- exhausting to make use of, poorly configured
Options
- Cloud detection (IPINFO API and Supply Code)
- Helps all main suppliers
- Black-Field (unauthenticated)
- Quick (concurrent)
- Modular and simply customizable
- Cross Platform (home windows, linux, mac)
- Consumer-Agent Randomization
- Proxy Randomization (HTTP, Socks5)
Supported Cloud Suppliers
Microsoft: – Storage – Apps
Amazon: – Storage – Apps
Google: – Storage – Apps
DigitalOcean: – storage
Vultr: – Storage
Linode: – Storage
Alibaba: – Storage
Model
1.0.0
Utilization
Simply obtain the most recent launch to your operation system and comply with the utilization.
To make one of the best use of this instrument, it’s important to perceive learn how to configure it appropriately. If you open your downloaded model, there’s a config folder, and there’s a config.YAML file in there.
It seems like this
suppliers: ["amazon","alibaba","amazon","microsoft","digitalocean","linode","vultr","google"] # supported suppliers
environments: [ "test", "dev", "prod", "stage" , "staging" , "bak" ] # used for mutations
proxytype: "http" # socks5 / http
ipinfo: "" # IPINFO.io API KEY
For IPINFO API, you may register and get a free key at IPINFO, the environments used to generate URLs, akin to test-keyword.goal.area and check.key phrase.goal.area, and many others.
We supplied some wordlist out of the field, but it surely’s higher to customise and reduce your wordlists (primarily based in your recon) earlier than executing the instrument.
After organising your API key, you might be prepared to make use of CloudBrute.
██████╗██╗ ██████╗ ██╗ ██╗██████╗ ██████╗ ██████╗ ██╗ ██╗████████╗███████╗
██╔════╝██║ ██╔═══██╗██║ ██║██╔══██╗██╔══██╗██╔══██╗██║ ██║╚══██╔══╝██╔════╝
██║ ██║ ██║ ██║██║ ██║██║ ██║██████╔╝██████╔╝██║ ██║ ██║ █████╗
██║ ██║ ██║ ██║██║ ██║██║ ██║██╔══██╗██╔══██╗██║ ██║ ██║ ██╔══╝
╚██████╗███████╗╚██████╔╝╚██████╔╝██████╔╝██████╔╝██║ ██║╚██████╔╝ ██║ ███████╗
╚═════╝╚══════╝ ╚═════╝ ╚═════╝ ╚═════╝ ╚═════╝ ╚═╝ ╚═╝ ╚═════╝ ╚═╝ ╚══════╝
V 1.0.7
utilization: CloudBrute [-h|--help] -d|--domain "" -k|--keyword ""
-w|--wordlist "" [-c|--cloud ""] [-t|--threads
] [-T|--timeout ] [-p|--proxy ""]
[-a|--randomagent ""] [-D|--debug] [-q|--quite]
[-m|--mode ""] [-o|--output ""]
[-C|--configFolder ""]Superior Cloud Enumerator
Arguments:
-h --help Print assist info
-d --domain area
-k --keyword key phrase used to generator urls
-w --wordlist path to wordlist
-c --cloud power a search, examine config.yaml suppliers listing
-t --threads variety of threads. Default: 80
-T --timeout timeout per request in seconds. Default: 10
-p --proxy use proxy listing
-a --randomagent consumer agent randomization
-D --debug present debug logs. Default: false
-q --quite suppress all output. Default: false
-m --mode storage or app. Default: storage
-o --output Output file. Default: out.txt
-C --configFolder Config path. Default: config
for instance
CloudBrute -d goal.com -k goal -m storage -t 80 -T 10 -w "./information/storage_small.txt"
please be aware -k key phrase used to generate URLs, so if you need the complete area to be a part of mutation, you’ve gotten used it for each area (-d) and key phrase (-k) arguments
If a cloud supplier not detected or need power looking on a selected supplier, you should utilize -c choice.
CloudBrute -d goal.com -k key phrase -m storage -t 80 -T 10 -w -c amazon -o target_output.txt
Dev
- Clone the repo
- go construct -o CloudBrute major.go
- go check inner
in motion
How one can contribute
- Add a module or repair one thing after which pull request.
- Share it with whomever you imagine can use it.
- Do the additional work and share your findings with neighborhood ♥
FAQ
How one can make one of the best out of this instrument?
Learn the utilization.
I get errors; what ought to I do?
Be sure to learn the utilization appropriately, and for those who suppose you discovered a bug open a difficulty.
After I use proxies, I get too many errors, or it is too gradual?
It is since you use public proxies, use personal and better high quality proxies. You should utilize ProxyFor to confirm the great proxies along with your chosen supplier.
too quick or too gradual ?
change -T (timeout) choice to get greatest outcomes to your run.
Credit
Impressed by each single repo listed right here .
