loading
Loading content
loading
Recon
List assets from multiple cloud providers in one inventory.
overview
cloudlist authenticates to provider APIs and lists the hostnames and IPs your accounts actually run. It is the authoritative inventory path, not an outside guess.
Point -provider-config at credentials, narrow with -provider or -service, and choose -host, -ip, or -json for the shape downstream nodes need. -exclude-private drops non-routable ranges.
Use when you hold keys. For exposed public names you do not own, use cloud-enum. Trickest runs it as a managed Recon node; wire the FILE output into httpx so probing tracks the current estate.
use cases
Read hosts and IPs from your provider accounts to produce an authoritative list of what the organization runs, not a guess from the outside.
Export hostnames and pass them to a prober and scanner so security runs cover the live estate rather than a stale spreadsheet.
Use -provider or -service to narrow the inventory to a single account or resource type when you only need part of the footprint.
Run cloudlist on a schedule and diff results to catch assets engineers add or remove over time.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| provider-config | FILE | -provider-config | Provider credentials config file that drives the inventory. |
| provider | STRING | -provider | Display results for the given providers, comma-separated (aws, gcp, azure, ...). |
| service | STRING | -service | Query and display results from the given services, comma-separated (ec2, s3, route53, ...). |
| host | BOOLEAN | -host | Display only hostnames in results. |
| ip | BOOLEAN | -ip | Display only IPs in results. |
| json | BOOLEAN | -json | Write output in JSON format. |
| exclude-private | BOOLEAN | -exclude-private | Exclude private IPs from CLI output. |
| id | STRING | -id | Display results for the given ids, comma-separated. |
Showing key inputs. cloudlist exposes 12 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| id | STRING | -id | display results for given ids (comma-separated) |
| ip | BOOLEAN | -ip | display only ips in results |
| host | BOOLEAN | -host | display only hostnames in results |
| json | BOOLEAN | -json | write output in json format |
| config | FILE | -config | cloudlist flag config file |
| silent | BOOLEAN | -silent | display only results in output |
| service | STRING | -service | query and display results from given service, comma-separated (default ingress,ecs,eks,lambda,nomad,instance,consul,custom,service,route53,fastly,cloud-run,elb,cloudfront,cloud-function,publicip,ec2,gke,droplet,domain,s3,compute,vm,app,dns,alb,lightsail,apigateway) |
| verbose | BOOLEAN | -v | display verbose output |
| provider | STRING | -provider | display results for given providers, comma-separated (default linode,nomad,openstack,custom,arvancloud,digitalocean,scw,cloudflare,heroku,kubernetes,aws,do,alibaba,namecheap,terraform,r1c,fastly,consul,hetzner,gcp,azure) |
| exclude-private | BOOLEAN | -exclude-private | exclude private ips in cli output |
| provider-config | FILE | -provider-config | provider config file |
| disable-update-check | BOOLEAN | -disable-update-check | disable automatic cloudlist update check |
example
# inventory AWS and GCP assets, drop private IPs, write resultscloudlist -provider-config providers.yaml -provider aws,gcp -exclude-private -o assets.txtapp.example.comapi.example.comstaging.example.comcdn.example.com198.51.100.24198.51.100.25203.0.113.10203.0.113.11vpn.example.com… (218 assets across 3 providers for the real run behind this page)guidance
Use cloudlist when you hold provider credentials and want a true inventory of the assets your accounts run. It reads accounts from the inside, so for finding public resources you do not own, use cloud-enum instead. It lists assets; it does not test them, so follow it with httpx.
Brute-forces public cloud names from outside. cloudlist reads your own accounts via their APIs.
Maps IP ranges from ASN data. cloudlist enumerates assets straight from cloud providers.
Broad OSINT discovery from public sources. cloudlist is authoritative for accounts you control.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Active multi-technique DNS enumeration for assessments.
Multi-purpose DNS toolkit for resolution, record queries, and wordlist brute force.
A provider config feeds cloudlist, which reads the accounts' assets and passes the hostnames to httpx so only live ones land as output.
Facts on this page come from the live Trickest tool library.