Recon
Find public cloud resources across AWS, Azure, and GCP
Multi-cloud public name enumeration for AWS, Azure, and GCP.
overview
What cloud-enum does
cloud-enum expands a company or product keyword into candidate bucket, container, and app names, then probes AWS, Azure, and GCP for which exist and whether they are open.
Drive scope with --keyword or --keyfile, widen with --mutations, and cut depth with --quickscan. --format chooses text, json, or csv for the log. --disable-aws, --disable-gcp, and --disable-azure drop providers you do not need.
Guesses from outside with no credentials. For an inventory of accounts you already hold keys for, use cloudlist instead. Trickest runs it as a managed Recon node that writes FILE and FOLDER outputs.
use cases
Where cloud-enum fits
Find exposed cloud storage
Brute-force bucket and container names from a keyword across AWS, Azure, and GCP to catch public storage a target left open.
Sweep all three clouds at once
Run one keyword against AWS, Azure, and Google so a single pass covers an organization's full multi-cloud footprint.
Expand a keyword with mutations
Point --mutations at a wordlist to generate realistic name variants, widening the search beyond the obvious base name.
Run a fast first pass
Enable quickscan to skip mutations and second-level scans when you want a quick read on a target's exposure.
reference
cloud-enum inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| keyword | STRING | --keyword | Bruteforce keyword the search is built from. |
| keywords-file | FILE | --keyfile | Input file with a single keyword per line. |
| mutations | FILE | --mutations | Mutations list to expand keywords (default fuzz.txt). |
| brute | FILE | --brute | List to brute-force Azure container names. |
| format | STRING | --format | Format for the log file (text, json, csv). |
| threads | STRING | --threads | Threads for HTTP brute-force (default 5). |
| quickscan | BOOLEAN | --quickscan | Disable all mutations and second-level scans. |
| nameserver | STRING | --nameserver | DNS server to use in the brute-force. |
Showing key inputs. cloud-enum exposes 11 inputs in total.
Full flag reference (11 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| brute | FILE | --brute | List to brute-force Azure container names. Default: enum_tools/fuzz.txt |
| format | STRING | --format | Format for log file (text, json, csv - defaults to text) |
| keyword | STRING | --keyword | Bruteforce keyword |
| threads | STRING | --threads | Threads for HTTP brute-force. Default = 5 |
| mutations | FILE | --mutations | Mutations. Default: enum_tools/fuzz.txt |
| quickscan | BOOLEAN | --quickscan | Disable all mutations and second-level scans |
| nameserver | STRING | --nameserver | DNS server to use in brute-force |
| disable-aws | BOOLEAN | --disable-aws | Disable Amazon checks |
| disable-gcp | BOOLEAN | --disable-gcp | Disable Google checks |
| disable-azure | BOOLEAN | --disable-azure | Disable Azure checks |
| keywords-file | FILE | --keyfile | Input file with a single keyword per line |
example
Run cloud-enum
# enumerate public buckets, containers, and apps across all three cloudscloud_enum --keyword example --mutations enum_tools/fuzz.txt --threads 10 --format json[+] Checking for S3 buckets OPEN S3 BUCKET: http://example-dev.s3.amazonaws.com/ PROTECTED S3 BUCKET: http://example-backups.s3.amazonaws.com/[+] Checking for Azure Storage Accounts OPEN AZURE CONTAINER: https://exampleassets.blob.core.windows.net/public/[+] Checking for Google buckets OPEN GOOGLE BUCKET: https://storage.googleapis.com/example-static/ PROTECTED GOOGLE BUCKET: https://storage.googleapis.com/example-logs/[+] All done, 4 open or protected resources across 3 cloudsguidance
Choosing cloud-enum
Reach for cloud-enum when you want public buckets, containers, and apps across AWS, Azure, and GCP from a keyword. It guesses names rather than reading provider accounts, so for listing assets in accounts you control, use cloudlist instead.
cloudlist
Lists assets from cloud accounts you hold credentials for. cloud-enum guesses public names from outside.
s3scanner
Focuses on S3 bucket discovery and permissions. cloud-enum covers AWS, Azure, and GCP together.
cloud_enum
Same project upstream. The managed node wraps it for multi-cloud brute-forcing in a workflow.
faq
cloud-enum questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloudlist
List assets from multiple cloud providers in one inventory.
Run cloud-enum yourself
A keyword feeds cloud-enum, which brute-forces names across AWS, Azure, and GCP and writes the public cloud resources it finds as output.
Facts on this page come from the live Trickest tool library.