Cloud asset discovery

SkillFiles & storage

Discover an organization's cloud footprint, buckets, blobs, apps, IP ranges, and services across AWS/GCP/Azure. Load during recon on a company target, on "cloud recon", finding storage/assets, or before cloud testing. Signals: an org name/domain in scope, assets on cloud CDNs, wildcard program.

Instructions available. Your AI can read the instructions. Execution depends on the setup they require.

Account requirements not reviewed. Check the skill instructions before use; ahel provides instructions and does not run this skill.

Add ahel to your AI once: Claude, ChatGPT, Cursor, Claude Code or Codex. Then ask it to use this.

Then ask your AI: use the Cloud asset discovery skill

What this skill tells your AI

The instructions your AI receives, as published by noorqureshi/sploitagent in skills/recon/recon-cloud-assets/SKILL.md and read by ahel’s review.

When it applies

Recon on an org where a lot of surface lives in the cloud. Mapping the cloud footprint surfaces storage exposure, forgotten apps, and IP ranges that feed the cloud-specific skills.

Why it works

Cloud resources use predictable naming and public namespaces (S3 bucket names are global; app services use *.azurewebsites.net, *.appspot.com, etc.). Permuting the org name across providers reveals assets that aren't linked from the main site.

Method

Permutation sweep: cloud_enum -k <company> -k <company>-prod -k <brand> to check AWS S3, Azure blobs/apps, and GCP buckets/apps for names derived from the org.
From existing assets: resolve subdomains/CNAMEs (→ recon-subdomain-enum, recon-dns-analysis) for cloud endpoints (*.s3.amazonaws.com, *.blob.core.windows.net, *.cloudfront.net).
IP ranges / ASN: find the org's ASN and cloud IP ranges; identify origin IPs behind CDNs.
Storage exposure: feed discovered buckets/containers to cloud-s3-exposure (list/read/write test).
Certificate transparency + favicon/Shodan (→ recon-osint) to catch cloud-hosted apps.

Gotchas

Stay in scope — cloud recon surfaces third-party SaaS and unrelated tenants; verify ownership.
Shared CDNs (Cloudflare/CloudFront) are not the org's infra — don't attack the CDN; find origin.
Anonymous bucket testing must be minimal (list/read a marker) — see cloud-s3-exposure for care.

Verify success

A map of in-scope cloud assets (buckets, apps, IP ranges) with any exposed storage flagged for follow-up by the cloud skills.

References

cloud_enum; s3scanner; "cloud recon" methodology; provider public-namespace docs.

Signals

GitHub stars: 20
Forks: 7
Last commit: Sep 2026

Advanced

Item type: skill
Key: recon-cloud-assets
Source: github.com/noorqureshi/sploitagent

github.com/noorqureshi/sploitagent