skills.rest
hanc00l
hanc00lCOMMUNITY
Explore all skills by this author →
GitHub

cloud-security

Detect cloud environments and extract metadata credentials via HTTP requests.

Updated Aug 23, 2026
Search Tags:#aws#gcp#azure#metadata#cloud#penetration-testing#ssrf
One-click install
npx skills add https://github.com/hanc00l/nemo-agent --skill cloud-security-hanc00l
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cloud-security
Source: https://github.com/hanc00l/nemo-agent/tree/main/claude-code/.claude/skills/pentest/cloud
Command: npx skills add https://github.com/hanc00l/nemo-agent --skill cloud-security-hanc00l

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

The skill enables security testers to discover and leverage cloud provider metadata services, revealing sensitive information such as instance details and temporary credentials that can lead to privilege escalation.

Core Features & Use Cases

  • Cloud detection: Probes known metadata endpoints to identify AWS, Azure, GCP, Alibaba Cloud, and Tencent Cloud environments.
  • Metadata exploitation: Provides Python snippets to fetch IAM credentials, user data, and other metadata via direct HTTP requests or SSRF techniques.
  • Attack scenarios: Guides through common vectors like SSRF, information leakage, and privilege escalation in cloud contexts.

Quick Start

Request the skill to scan the target URL for cloud metadata and return any discovered credentials.

Frequently Asked Questions about cloud-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract AWS metadata credentials during a penetration test?▼

You can extract cloud metadata credentials by sending direct HTTP requests to known metadata endpoints and parsing the returned JSON data. This approach works for AWS, Azure, GCP, Alibaba Cloud, and Tencent Cloud without needing external SDKs.

Can I use SSRF to discover cloud instance metadata on Azure and GCP?▼

Yes, you can leverage SSRF techniques to query known metadata endpoints and discover sensitive information on Azure and GCP. This method helps uncover instance details and temporary credentials that can lead to privilege escalation.

Do I need external SDKs to fetch IAM credentials from cloud metadata services?▼

No external SDKs are required to fetch IAM credentials from cloud metadata. The skill leverages direct HTTP requests to known endpoints and parses the JSON credential data without any external dependencies.

What cloud environments are supported for metadata detection and exploitation?▼

Supported cloud environments include AWS, Azure, GCP, Alibaba Cloud, and Tencent Cloud. The detection process probes known metadata endpoints specific to each provider to identify the active environment and extract instance details.

What type of sensitive information can be uncovered through cloud metadata exploitation?▼

Cloud metadata exploitation uncovers sensitive information including instance details, user data, and temporary IAM credentials. Extracting these credentials can directly lead to privilege escalation within the compromised cloud environment.

Related Skills

Explore More Software Engineering Skills→
SkobynSkobyn

hunt-ssrf

Detect and exploit SSRF vulnerabilities in web applications.

Community
Advanced
pdparchitectpdparchitect
13

cloud-iam-deep

Analyze cloud IAM privilege escalation paths across AWS, Azure, and GCP.

Community
Advanced
balsm-healthbalsm-health
2

exploiting-server-side-request-forgery

Automate SSRF vulnerability testing and exploitation during authorized penetration tests.

Official
Advanced
k2worksk2works

operating-cicd

Automate Node.js CI/CD pipelines with GitHub Actions and OIDC deployments.

Community
Advanced