skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

hunt-cloud-misconfig

Detect cloud misconfigurations across AWS, GCP, and Azure environments.

3|1|Updated Jul 2, 2026
Search Tags:#security#aws#reconnaissance#cloud#pentesting#misconfiguration#ssrf
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-cloud-misconfig-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-cloud-misconfig
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/hunt-cloud-misconfig
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-cloud-misconfig-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the high-risk challenge of identifying exposed cloud resources and misconfigurations that could lead to data breaches or unauthorized access.

Core Features & Use Cases

  • Automated Reconnaissance: Detects public S3 buckets, exposed CloudFront origins, and accessible metadata services via SSRF.
  • Credential & Secret Extraction: Scans JS bundles for leaked identity pool IDs and guest role ARNs.
  • Validation Workflow: Provides a safe, local-verification toolchain using LocalStack to confirm findings without impacting production environments.

Quick Start

Initiate a cloud misconfiguration scan against the target domain by providing the hostname to the hunt-cloud-misconfig skill.

Frequently Asked Questions about hunt-cloud-misconfig

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan for exposed S3 buckets and cloud misconfigurations during a pentest?▼

You can scan for exposed S3 buckets and cloud misconfigurations by running automated reconnaissance against a target hostname. This detects public storage, exposed CloudFront origins, and accessible metadata services to identify unauthorized access vectors.

Can I detect leaked IAM credentials and identity pool IDs in JavaScript bundles?▼

Yes, you can detect leaked IAM credentials by scanning JavaScript bundles for extracted identity pool IDs and guest role ARNs. This identifies exposed cloud identity secrets that could enable unauthorized infrastructure access.

Does this cloud reconnaissance approach work across AWS, GCP, and Azure environments?▼

Yes, this cloud reconnaissance applies to security assessments across AWS, GCP, and Azure environments. It identifies unauthorized access vectors by validating misconfigurations like public storage buckets and exposed metadata services.

How do I safely validate SSRF and cloud metadata service exposure findings?▼

You safely validate SSRF and metadata service findings using a local Docker-based simulation with LocalStack. This verification toolchain confirms misconfigurations without impacting or interacting with production cloud environments.

What do I need to run an automated cloud misconfiguration scan?▼

You need network connectivity for remote reconnaissance and a local Docker environment to run LocalStack for safe verification. Provide the target hostname to initiate the scan and detect exposed cloud infrastructure resources.

Related Skills

Explore More Software Engineering Skills→
TurnaboutHeroTurnaboutHero
12

devops-engineer

Automate CI/CD pipelines, Docker builds, and Kubernetes deployments across cloud environments.

Community
Advanced
pdparchitectpdparchitect
13

cloud-iam-deep

Analyze cloud IAM privilege escalation paths across AWS, Azure, and GCP.

Community
Advanced
balsm-healthbalsm-health
2

exploiting-server-side-request-forgery

Automate SSRF vulnerability testing and exploitation during authorized penetration tests.

Official
Advanced
devkenidevkeni
1

cloud-security

Automate multi-cloud security assessments across AWS, Azure, and GCP.

Community
Advanced