# Cloud Sleuthing: Decoding AWS Infrastructure

# Overview

AWS a.k.a Amazon Web Services is one of the oldest and most widely used cloud service providers. At the time of writing this blog, AWS has over 200 services across different domains (Compute, Machine Learning, Security, etc).

AWS services can be managed via two ways :-

1.  AWS Console (Web Interface)
    
2.  AWS CLI (CLI-based access)
    

Most commonly used, public-facing AWS services are as follows :-

1.  Elastic Compute Cloud (EC2) \[We will skip it for the purpose of this blog\]
    
2.  Simple Storage Service (S3)
    
3.  Elastic Load Balancer (ELB)
    
4.  CloudFront
    
5.  Cognito
    

# Simple Storage Service (S3)

Simple Storage Service a.k.a S3 is a cloud object storage service providing secure and scalable storage capacity to the customers. S3 stores the data in the form of objects inside storage units known as buckets. These buckets contain the data object, metadata, and a unique identifier. It’s important to note that the S3 bucket names are unique across all buckets in a region, thus no two buckets can have the exact same name. While mainly used for storing data, an interesting feature of these buckets include hosting static websites.

![](https://cdn.hashnode.com/uploads/covers/6420ae34bdbe7d697133ca34/b8775141-44ec-4afb-b1d9-d174196d4329.png align="center")

Image Source: https://aws.amazon.com/s3/

## URL format

S3 currently provides two naming conventions for the buckets as follows :-

### **Where bucket name is prepended :-**

```shell
[BUCKET_NAME].s3.amazonaws.com/
```

*For e.g: example.s3.amazonaws.com/*

### **Where bucket name is appended :-**

```shell
s3.amazonaws.com/[BUCKET_NAME]/
```

*For e.g: s3.amazonaws.com/example*

## Recon via publicly available Buckets

A large number of buckets are publicly available and accessible to the general public. This ranges the buckets belonging to an individual freelancer to multinational companies. In case we discover a bucket that is misconfigured, it can either yield important information or allow us to gain access to the AWS environment.

![](https://cdn.hashnode.com/uploads/covers/6420ae34bdbe7d697133ca34/ba680a4c-0b9e-4c8b-bd20-4d3adfa9212c.png align="center")

## Recon via Google Dorks

### **Query :-**

```shell
site:*.s3.amazonaws.com "Confidential"
```

![](https://cdn.hashnode.com/uploads/covers/6420ae34bdbe7d697133ca34/e97eff92-4790-40c7-b465-b3bb7489374a.png align="center")

## Recon via Github Dorks

### **Query :-**

```shell
s3.amazonaws.com
```

![](https://cdn.hashnode.com/uploads/covers/6420ae34bdbe7d697133ca34/1c1593a8-4a2a-4984-ace8-c6886265ffd3.png align="center")

# Elastic Load Balancer (ELB)

Elastic Load Balancer a.k.a ELB is a load balancing service which distributes incoming traffic to different AWS services (IP address, EC2 Instance, Lambda function, etc) based on pre-configured rules across various availability zones.

At the time of writing this blog, AWS provides four different types of ELB’s as follows :-

1.  Application Load Balancer (ALB) : Operates on layer 7 with support for HTTP, HTTPS, and gRPC
    
2.  Classic Load Balancer (CLB) : Operates on layer 4 & layer 7 with support for TCP, SSL/TLS, HTTP, and HTTPS
    
3.  Gateway Load Balancer (GLB) : Operates on layer 3 & layer 4 with support for IP
    
4.  Network Load Balancer (NLB) : Operates on layer 4 with support for TCP, UDP, and TLS
    

## Recon via Shodan

### **Query 1 :-**

```shell
cloud.provider:Amazon product:"AWS ELB"
```

![](https://cdn.hashnode.com/uploads/covers/6420ae34bdbe7d697133ca34/a01b3680-e4bc-4477-9f46-f897c635e45e.png align="center")

### **Query 2 :-**

```shell
Set-Cookie: AWSALB
```

![](https://cdn.hashnode.com/uploads/covers/6420ae34bdbe7d697133ca34/a913afc6-e781-441b-971d-eaba92818d89.png align="center")

### **Query 3 :-**

```shell
Location: elb.amazonaws.com
```

![](https://cdn.hashnode.com/uploads/covers/6420ae34bdbe7d697133ca34/b8d0e090-c0f3-4dee-be8d-9d334848a6a2.png align="center")

## Recon via Censys

### **Query 1 :-**

```shell
((services.http.response.headers: (key: "Set-Cookie" and value.headers: "AWSALB")) and autonomous_system.name=AMAZON-02) and labels=login-page\
```

![](https://cdn.hashnode.com/uploads/covers/6420ae34bdbe7d697133ca34/a46d57ea-fb43-4c31-bb1c-95da835bb290.png align="center")

### **Query 2 :-**

```shell
dns.names: "elb.amazonaws.com"
```

![](https://cdn.hashnode.com/uploads/covers/6420ae34bdbe7d697133ca34/8b250916-c1b4-4ef0-afb6-bf2d987df9fb.png align="center")

# CloudFront

CloudFront is a globally distributed, content delivery network providing low-latency network connectivity across the globe. CloudFront supports the delivery of data (including audio/video), applications, and API among other formats. Additionally, it supports EC2, ELB, and custom origins as the backend (data host).

![](https://cdn.hashnode.com/uploads/covers/6420ae34bdbe7d697133ca34/c1dca538-eb15-4846-82f7-aa3975f47ca5.png align="center")

Image Source: [https://aws.amazon.com/cloudfront/](https://aws.amazon.com/cloudfront/)

## Recon via Shodan

### Query :-

```shell
User-Agent: Amazon Cloudfront
```

![](https://cdn.hashnode.com/uploads/covers/6420ae34bdbe7d697133ca34/69b7caf0-9e7f-46fd-9964-705a192a5cd4.png align="center")

## Recon via Censys

### Query :-

```shell
(services.http.response.headers.key: "X-Amz-Cf-Id") and labels=remote-access
```

![](https://cdn.hashnode.com/uploads/covers/6420ae34bdbe7d697133ca34/710179a0-c880-42c8-991b-93d07a2da9fe.png align="center")

# Cognito

Cognito is a Customer Identity & Access Management (CIAM) service which offers IAM services applications (WebApp, Mobile App, etc).

Cognito provides two kinds of offerings as follows :-

1.  User Pool: Signup/Login based on user directories
    
2.  Identity Pool: Access other AWS services through Cognito elements
    

![](https://cdn.hashnode.com/uploads/covers/6420ae34bdbe7d697133ca34/8a2f3810-8737-4ed8-aebb-c892110bf448.png align="center")

Image Source: [https://aws.amazon.com/cognito/](https://aws.amazon.com/cognito/)

## Recon via Shodan

### Query 1 :-

```shell
Location: aws.cognito.signin.user.admin
```

![](https://cdn.hashnode.com/uploads/covers/6420ae34bdbe7d697133ca34/182d179d-565b-4359-99b9-7e17b0b8b1a6.png align="center")

### Query 2 :-

```shell
amazoncognito.com
```

![](https://cdn.hashnode.com/uploads/covers/6420ae34bdbe7d697133ca34/c2750d2c-eee5-410d-a50f-826aae2dcc38.png align="center")

## Recon via Censys

### Query 1:-

```shell
"aws.cognito.signin.user.admin"
```

![](https://cdn.hashnode.com/uploads/covers/6420ae34bdbe7d697133ca34/f60a418f-0f94-4ee1-8374-3854a759367d.png align="center")

# Ending Notes

Cloud services are often exposed to the public for the operational working of a company. In some instances, the misconfigured permissions expose more than what should be out there. Additionally, there are lots of Internet Intelligence services which map a large majority of services which has an associated hostname.

For me it's a fun way to spend evenings mapping what is exposed out here and usually I find some gems which should be protected by strict IAM permissions, but are not.