skills.rest
uphiago
uphiagoCOMMUNITY
Explore all skills by this author →
Website𝕏@uphiagoGitHub

hunt-cloud-misconfig

Detect cloud misconfigurations across AWS, GCP, and Azure environments.

1.1k|191|Updated Jun 24, 2026
Search Tags:#aws#gcp#azure#pentesting#ssrf#cloud-security#misconfig-detection
One-click install
npx skills add https://github.com/uphiago/recon-skills --skill hunt-cloud-misconfig-uphiago
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-cloud-misconfig
Source: https://github.com/uphiago/recon-skills/tree/main/redteam/hunt-cloud-misconfig
Command: npx skills add https://github.com/uphiago/recon-skills --skill hunt-cloud-misconfig-uphiago

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill eliminates the manual, time-consuming process of identifying hard-to-detect cloud and infrastructure misconfigurations across AWS, GCP, and Azure that could lead to sensitive data leaks, unauthorized access, or full cloud account takeover, which are often missed by automated vulnerability scanners.

Core Features & Use Cases

  • Multi-cloud misconfig detection: Covers public S3/GCS/Azure Blob storage, permissive bucket policies, exposed serverless functions (Lambda, Cloud Run, Azure Function Apps), public managed services (RDS snapshots), and IAM credentials leaked in client-side JavaScript bundles.
  • SSRF-enabled metadata exploitation: Detects and validates access to cloud instance metadata endpoints (such as AWS IMDS) via SSRF vulnerabilities to extract temporary IAM credentials for further enumeration.
  • Validated reporting support: Includes local testing integration with LocalStack, a severity rubric for findings, and a pre-report validation checklist to ensure only legitimate, high-impact issues are disclosed. Use case: A penetration tester assessing a client's cloud environment can use this Skill to quickly identify public S3 buckets containing sensitive user data, extract overpermissioned IAM roles from exposed CloudWatch RUM snippets, and validate the severity of the finding before submitting a bug bounty report.

Quick Start

Use the hunt-cloud-misconfig skill to scan the target domain for public cloud storage buckets, exposed CloudWatch RUM snippets with overpermissioned IAM roles, and accessible cloud metadata endpoints to identify critical cloud misconfiguration risks.

Frequently Asked Questions about hunt-cloud-misconfig

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find cloud misconfigurations across AWS, GCP, and Azure during a pentest?▼

You can hunt cloud misconfigurations across AWS, GCP, and Azure by scanning for public storage buckets, exposed serverless functions, and leaked IAM credentials in client-side bundles to identify unauthorized data access risks.

Can SSRF vulnerabilities be used to extract AWS IAM credentials from metadata endpoints?▼

Yes, SSRF vulnerabilities can be used to access cloud instance metadata endpoints like AWS IMDS, allowing you to extract temporary IAM credentials for further enumeration and privilege escalation.

How do I detect leaked IAM credentials in JavaScript bundles?▼

To detect leaked IAM credentials in JavaScript bundles, scan client-side code for exposed snippets like CloudWatch RUM configurations that contain overpermissioned IAM roles for unauthorized access.

What is the best way to validate cloud misconfiguration findings before reporting?▼

The best way to validate cloud misconfiguration findings before reporting is using a severity rubric and local validation tooling like LocalStack to ensure only legitimate, high-impact issues are disclosed.

Does this multi-cloud misconfig detection cover public managed database snapshots?▼

Yes, multi-cloud misconfig detection covers public managed database snapshots, including exposed RDS snapshots, alongside public S3, GCS, and Azure Blob storage buckets with permissive policies.

Related Skills

Explore More Software Engineering Skills→
Carlos-Reyes-UTPCarlos-Reyes-UTP
2

hunt-cloud-misconfig

Enumerate cloud misconfigurations enabling unauthorized access across storage, compute, and CI/CD platforms.

Community
Advanced
JayRHaJayRHa
3

security-auditor

Audit codebases against the OWASP Top 10 (2021) and generate prioritized findings reports.

Community
Advanced
wgpsecwgpsec
1.6k

cloud-metadata

Detect and exploit cloud instance metadata across AWS, Azure, GCP, Alibaba Cloud, and Tencent Cloud.

Official
Advanced
virtualrusselvirtualrussel
1

dt-obs-azure

Query Azure APIs to inspect resource configurations, security posture, and performance metrics.

Community
Advanced