Cloud And Infra

---
name: cloud-and-infra
description: "Cloud-native service fingerprints, Kubernetes/container exposure, CI/CD platform exposure, TLS deep audit, and favicon hash pivot for authorized infrastructure recon."
when_to_use: "Use for cloud-native service fingerprinting (Lambda function URLs, Cloud Run), Kubernetes/container exposure (kubelet, etcd, Docker API, container registries), CI/CD platform exposure (Jenkins, self-hosted GitLab, GitHub Actions secrets, Argo CD), TLS deep audits (JA3/JA4), or favicon-hash pivoting."
---

# Cloud & Infrastructure OSINT

> Sub-skill of `offensive-osint`. Load `osint-methodology` for pipeline and triage context.
> Authorized targets only.

---

## BEHAVIORAL CONTRACT

**When triggered:** Cloud-native service fingerprinting, Kubernetes/container exposure, CI/CD platform exposure, TLS deep audit, or container registry leak hunting is needed.

**Execute:**

1. For each discovered subdomain/IP, match against cloud-native URL patterns (§1). Classify provider and service type.
2. Check public-vs-auth-required on each cloud function endpoint (HEAD/GET).
3. For K8s/container exposure: probe ports from §2 table (Docker 2375/2376, kubelet 10250, etcd 2379, K8s API 6443/8443). Anonymous access = CRITICAL.
4. Check CI/CD platforms (§3) for unauthenticated access.
5. Run TLS deep audit (§4) on every HTTPS endpoint in scope.
6. Check public container registries (§2) for target-owned images.
7. For each finding, emit per `osint-methodology` §3 schema.

**Output:** Infrastructure findings with provider, service type, auth posture, severity. All per `osint-methodology` §3 schema.

**Severity rules:** Inline per section tables. Docker API unencrypted = CRITICAL. Open kubelet = CRITICAL. Open etcd = CRITICAL. K8s API anonymous = HIGH. TLS 1.0/1.1 = MEDIUM.

**Gating rules:** Active port probing is HIGH detectability — confirm authorization. Container image pulls generate logs — note detectability.

**Chain to:** Feed discovered cloud endpoints to `web-surface` for HTTP checks. Feed K8s findings to `analysis-and-reporting` for attack-path hints. For ASN/BGP lookups, use `recon-asset-discovery`.

---

## 1. Cloud-Native Service Fingerprints

| Provider                      | URL pattern                            | Notes                                                                 |
| ----------------------------- | -------------------------------------- | --------------------------------------------------------------------- |
| **AWS Lambda Function URL**   | `*.lambda-url.<region>.on.aws`         | Direct invocation; check IAM auth posture                             |
| **AWS App Runner**            | `*.<region>.awsapprunner.com`          | Managed container                                                     |
| **AWS API Gateway**           | `*.execute-api.<region>.amazonaws.com` | REST/HTTP/WebSocket; check authorizer                                 |
| **AWS CloudFront**            | `d{14}\.cloudfront\.net`               | Distribution; find origin via `docs/methods/cdn-bypass-techniques.md` |
| **AWS ALB / ELB**             | `*.elb.<region>.amazonaws.com`         | Behind = EC2 / ECS                                                    |
| **AWS Amplify**               | `*.amplifyapp.com`                     | Static + Lambda backend                                               |
| **Google Cloud Run**          | `*.run.app` (and `*.<region>.run.app`) | Check public-vs-IAM auth                                              |
| **Google Cloud Functions**    | `*.cloudfunctions.net`                 | Serverless                                                            |
| **Google App Engine**         | `*.appspot.com`                        | Older serverless                                                      |
| **Azure Functions**           | `*.azurewebsites.net`                  | Function App; also App Service                                        |
| **Azure Container Apps**      | `*.azurecontainerapps.io`              | Containers                                                            |
| **Vercel**                    | `*.vercel.app`, `*.now.sh` (legacy)    | Frontend + serverless                                                 |
| **Netlify**                   | `*.netlify.app`, `*.netlify.com`       | Frontend + functions                                                  |
| **Cloudflare Workers**        | `*.workers.dev`                        | Edge functions                                                        |
| **Cloudflare Pages**          | `*.pages.dev`                          | Static + functions                                                    |
| **Heroku**                    | `*.herokuapp.com`                      | Dynos                                                                 |
| **Render**                    | `*.onrender.com`                       | Container/static                                                      |
| **Railway**                   | `*.railway.app`                        | App platform                                                          |
| **DigitalOcean App Platform** | `*.ondigitalocean.app`                 | Static + container                                                    |

**Per-platform checks:**

- Confirm public vs auth-required (HEAD / GET).
- Check CORS posture.
- Lambda Function URLs / Cloud Run / Cloud Functions: anonymous invocation = HIGH finding.
- Static + functions hybrids (Vercel/Netlify): function paths usually `/api/*`; enumerate via JS extraction.

---

## 2. Container & Kubernetes Exposure

| Target                                         | Port                 | Probe                                                                                           | Severity                           |
| ---------------------------------------------- | -------------------- | ----------------------------------------------------------------------------------------------- | ---------------------------------- |
| **Docker API (unencrypted)**                   | 2375                 | `curl -sk -m 5 <http://${IP}:2375/v1.40/info`>                                                  | CRITICAL                           |
| **Docker API (TLS)**                           | 2376                 | `curl -sk -m 5 <https://${IP}:2376/v1.40/info`>                                                 | HIGH                               |
| **Kubernetes API server**                      | 6443 / 8443          | `curl -sk -m 5 <https://${IP}:6443/api`>                                                        | HIGH if anonymous non-403          |
| **kubelet**                                    | 10250 (HTTPS)        | `curl -sk -m 5 <https://${IP}:10250/pods`>                                                      | CRITICAL (no auth = pod exec)      |
| **etcd**                                       | 2379 (client)        | `curl -sk -m 5 <https://${IP}:2379/v2/keys/`>                                                   | CRITICAL (cluster state + secrets) |
| **Kubernetes Dashboard**                       | 8001 / 9090 / 30000+ | `curl -sk -m 5 <http://${IP}:8001/api/v1/namespaces/kube-system/services/kubernetes-dashboard`> | HIGH                               |
| **kube-controller-manager**                    | 10257                | `curl <https://${IP}:10257/metrics`>                                                            | MEDIUM                             |
| **kube-scheduler**                             | 10259                | `curl <https://${IP}:10259/metrics`>                                                            | MEDIUM                             |
| **Helm Tiller** (Helm 2, deprecated but found) | 44134                | `helm --host ${IP}:44134 list`                                                                  | HIGH                               |

**Container registries to check for leaks:**

| Registry                        | Search pattern                                                                                  |
| ------------------------------- | ----------------------------------------------------------------------------------------------- |
| Docker Hub                      | `<https://hub.docker.com/search?q=<target-keyword>>&type=image`                                 |
| Quay (Red Hat)                  | `<https://quay.io/search?q=<target-keyword>>`                                                   |
| GitHub Container Registry       | `<https://api.github.com/orgs/<org>>/packages?package_type=container`                           |
| Amazon ECR Public               | `<https://gallery.ecr.aws/?searchTerm=<keyword>>`                                               |
| Google Container Registry (GCR) | `<https://gcr.io/v2/<project-id>>/tags/list` (also try `us.gcr.io`, `eu.gcr.io`, `asia.gcr.io`) |
| Azure Container Registry (ACR)  | `<https://<registry>>.azurecr.io/v2/_catalog` (anonymous pull if enabled)                       |

**Per-image scan workflow:**

```bash
docker pull <registry>/<image>:<tag>
docker save <image> -o /tmp/img.tar
# Extract layers; run secret catalog over files
docker history <image>   # inspect build args + COPY of secrets
```

---

## 3. CI/CD Platform Exposure

| Platform               | Common exposure                                               | Probe                                                         |
| ---------------------- | ------------------------------------------------------------- | ------------------------------------------------------------- |
| **Jenkins**            | `/script` (Groovy console = RCE if no auth), `/asynchPeople/` | `curl -sk -m 10 "${T}/script"`                                |
| **GitLab self-hosted** | Version in HTML; `/api/v4/version`                            | `curl -sk -m 10 "${T}/api/v4/version"`                        |
| **TeamCity**           | `/login.html`; CVE-2024-27198 (KEV)                           | `curl -sk -m 10 "${T}/login.html" \| grep -i TeamCity`        |
| **Argo CD**            | `/api/version`; anonymous-auth posture                        | `curl -sk -m 10 "${T}/api/version"`                           |
| **Bamboo**             | `/rest/api/latest/info`                                       | `curl -sk -m 10 "${T}/rest/api/latest/info"`                  |
| **Drone CI**           | `/api/info`                                                   | `curl -sk -m 10 "${T}/api/info"`                              |
| **Spinnaker**          | `/gate/info`, `/applications`                                 | `curl -sk -m 10 "${T}/gate/info"`                             |
| **CircleCI**           | `/api/v2/me` (token leak → project enum), public build logs   | `curl -sk -m 10 "${T}/api/v2/me" -H "Circle-Token: ${TOKEN}"` |

**GitHub Actions secret-leak anti-patterns:**

```yaml
# Anti-pattern: secret echoed to log
run: echo "${{ secrets.MY_API_KEY }}"

# Anti-pattern: pull_request_target with fork code checkout (CVE class)
on: pull_request_target
jobs:
  test:
    steps:
      - uses: actions/checkout@v3
        with:
          ref: ${{ github.event.pull_request.head.sha }} # checks out fork code with secrets in env
```

---

## 4. TLS Deep Audit

Beyond cert SAN + JARM — inspect cipher suites, protocols, and config quality.

```bash
# sslyze (most thorough — install: see docs/reference/tooling-install.md)
sslyze --regular target.example:443
sslyze --json_out=tls.json target.example:443

# testssl.sh (thorough + readable)
docker run --rm -ti drwetter/testssl.sh https://target.example
testssl.sh --jsonfile-pretty=tls-report.json target.example:443

# nmap (lighter)
nmap --script ssl-enum-ciphers,ssl-cert -p 443 target.example
```

**Issues to check:**

| Issue                                 | Severity                         |
| ------------------------------------- | -------------------------------- |
| TLS 1.0 / 1.1 supported               | MEDIUM (PCI-DSS forbids TLS 1.0) |
| SSL 3.0 / 2.0 supported               | HIGH                             |
| Weak ciphers (RC4, 3DES, CBC modes)   | MEDIUM                           |
| Anonymous DH                          | HIGH                             |
| Weak key size (<2048 RSA, <256 ECDSA) | HIGH                             |
| Heartbleed (CVE-2014-0160)            | CRITICAL                         |
| ROBOT (CVE-2017-13099)                | HIGH                             |
| Ticketbleed (CVE-2016-9244)           | HIGH (F5-specific)               |
| HSTS not present on /login            | HIGH                             |
| Self-signed cert on production        | MEDIUM                           |
| Expired cert                          | MEDIUM                           |

**JA3/JA4 reference databases:**

- [ja3er.com](https://ja3er.com) — JA3 → client-software mapping.
- Shodan `ssl.jarm:<hash>` to find shared infrastructure / origin candidates.

---

## 5. Favicon mmh3 Hash Pivot

```bash
python3 -c "
import urllib.request, codecs, mmh3
data = urllib.request.urlopen('https://target.example/favicon.ico').read()
print(mmh3.hash(codecs.encode(data, 'base64')))"
shodan search "http.favicon.hash:<hash>" --fields ip_str,port,org
```

---

> **Note:** For ASN/BGP and internet measurement, see `recon-asset-discovery`. For reverse DNS sweep and IPv6 enumeration scripts, see `docs/methods/active-sweep-scripts.md`.

## Structured Outrider run contract

Follow the shared run-contract instructions in `../_shared/run-contract.md`.

- Contract skill identifier: `cloud-and-infra`.
- Consume `skill_request` version 1 and produce `skill_result` version 1 when participating in an Outrider run.
- Use evidence IDs for all claims; do not cite unregistered local paths as claim evidence.
- Discoveries are observations and do not expand scope or approval.
- Do not claim final finding validation; use `finding_candidate` only when a human-reviewed candidate should be handed off.
- Do not directly edit `manifest.json`, `scope.yaml`, `run.jsonl`, `evidence.jsonl`, or `approvals.jsonl`.
- Use policy-gated MCP with the explicit `run_dir`; the Python control layer and MCP boundary must reevaluate current controls.