Hunt cloud / infrastructure misconfigurations. AWS: public S3 buckets (s3:GetObject anonymous), permissive bucket policies (PutObjectAcl public-write), exposed CloudFront origin, public Lambda function URL, public RDS snapshot, IAM credentials in JS bundles, AWS metadata accessible via SSRF. GCP: public GCS buckets, exposed Cloud Run services, leaked service account JSON. Azure: public blob containers, exposed Function App. (Kubernetes/Docker exposure is owned by hunt-k8s; CI/CD pipeline attacks by hunt-cicd; post-credential IAM escalation by cloud-iam-deep.) Detection: targeted dorking, certificate transparency, JS bundle secret extraction, port scan for known service ports. Validate: actual data read / write / RCE. Use when hunting cloud-native storage and compute misconfig (S3/GCS/Blob, IMDS-via-SSRF, serverless, public managed services).
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Hunt cloud / infrastructure misconfigurations. AWS: public S3 buckets (s3:GetObject anonymous), permissive bucket policies (PutObjectAcl public-write), exposed CloudFront origin, public Lambda function URL, public RDS snapshot, IAM credentials in JS bundles, AWS metadata accessible via SSRF. GCP: public GCS buckets, exposed Cloud Run services, leaked service account JSON. Azure: public blob containers, exposed Function App. (Kubernetes/Docker exposure is owned by hunt-k8s; CI/CD pipeline attacks by hunt-cicd; post-credential IAM escalation by cloud-iam-deep.) Detection: targeted dorking, certificate transparency, JS bundle secret extraction, port scan for known service ports. Validate: actual data read / write / RCE. Use when hunting cloud-native storage and compute misconfig (S3/GCS/Blob, IMDS-via-SSRF, serverless, public managed services).
# S3 listing
curl --max-time 30 --connect-timeout 10 -s "https://TARGET-NAME.s3.amazonaws.com/?max-keys=10"
aws s3 ls s3://target-bucket-name --no-sign-request
# Try common bucket namesfor name in target target-backup target-assets target-prod target-staging; do
curl --max-time 30 --connect-timeout 10 -s -o /dev/null -w "$name: %{http_code}\n""https://$name.s3.amazonaws.com/"done# Firebase open rules
curl --max-time 30 --connect-timeout 10 -s "https://TARGET-APP.firebaseio.com/.json"# read
curl --max-time 30 --connect-timeout 10 -s -X PUT "https://TARGET-APP.firebaseio.com/test.json" -d '"pwned"'# write
EC2 Metadata (via SSRF)
http://[REDACTED_IP]/latest/meta-data/iam/security-credentials/ # role name
http://[REDACTED_IP]/latest/meta-data/iam/security-credentials/ROLE-NAME # keys
For testing cloud-misconfig findings against a local AWS sim before/instead of hitting real cloud:
# LocalStack 3.0 community (pin the version — 4.x requires a Pro license)
docker run -d --name lab-localstack -p 14566:4566 localstack/localstack:3.0
# awscli ≥ 2.30 + LocalStack 3.0 incompatibility workaround (x-amz-trailer header):export AWS_REQUEST_CHECKSUM_CALCULATION=when_required
export AWS_RESPONSE_CHECKSUM_VALIDATION=when_required
export AWS_ENDPOINT_URL=http://localhost:14566
export AWS_ACCESS_KEY_ID= AWS_SECRET_ACCESS_KEY= AWS_DEFAULT_REGION=us-east-1
test
test
Without those env vars, aws s3 cp/sync fails with InvalidRequest. Document this for the team. See docs/verification/phase2j-cloud-localstack.md for the full reproducible flow.
CloudWatch RUM Weaponization (2024-2026 surface)
AWS CloudWatch RUM (Real-User Monitoring) is a client-side telemetry service launched late 2021. Customers embed a JS snippet on their pages that sends performance/error events to dataplane.rum.<region>.amazonaws.com. The snippet's AppMonitor config contains an identityPoolId (Cognito) and guestRoleArn (IAM role) — both public by design. The IAM role policy is the security boundary, and when developers leave it broader than the documented minimum (rum:PutRumEvents on the AppMonitor ARN), the entire pool becomes the unauthenticated AWS-credential vending machine described in cloud-iam-deep → Cognito Identity Pool chain.
Full chain documented in cloud-iam-deep → Cognito Identity Pool unauthenticated chain. RUM is one common embedding context.
Chain B — Telemetry endpoint covert exfil.dataplane.rum.<region>.amazonaws.com is an AWS-owned domain on every enterprise allowlist. The PutRumEvents payload accepts arbitrary userDetails and customEvents string fields:
Defenders watching egress see traffic to a known-good AWS hostname; DLP doesn't parse the JSON body; SIEM rules typically don't ingest customer RUM telemetry.
Chain C — DOM injection via snippet source poisoning. Many customers either self-host cwr.js on their own CDN (assets.target.com/cwr.js) or bundle aws-rum-web and serve from static.target.com/main.<hash>.js. Subdomain takeover on the JS host or supply-chain compromise (npm typosquat against aws-rum-webb) gives persistent JS execution on every page-load with the trust of the aws-rum-web SDK — including its already-granted Cognito permissions.
Chain D — Telemetry injection / dashboard poisoning. With the public identityPoolId + applicationId, an external attacker can flood PutRumEvents with fake error spikes (drown real alerts), inject XSS payloads into page-URL telemetry that fire when an SOC analyst views the CloudWatch dashboard, and inflate billable RUM event counts (financial DoS).
Severity rubric
Finding
Severity
Justification
guestRoleArn with *:* or wildcards on multiple services
Critical (9.1+)
Anonymous full AWS access
guestRoleArn with s3:*, dynamodb:*, secretsmanager:*, lambda:Invoke* on production resources
High (7.5-8.8)
Data exfil / RCE depending on resource
guestRoleArn with cognito-identity:* or iam:PassRole
High (8.0)
Privilege escalation primitive
guestRoleArn with only rum:PutRumEvents + endpoint-scoped resource
Informational
Documented, intended config
RUM userDetails logging PII into events viewable in CloudWatch console
Medium (5.3-6.5)
Sensitive data exposure via dashboard sharing
RUM AppMonitor accepts PutRumEvents from arbitrary internet sources (telemetry injection)
Low-Medium (4.3)
Dashboard poisoning, alert evasion, billing DoS
Self-hosted cwr.js on takeoverable subdomain
Critical (9.8) when chained
Persistent stored XSS across every customer page
Disclosed cases / authoritative writeups
No CVE assigned specifically to AWS RUM as of 2026-05. The attack class is documented in research but specific named bug-bounty payouts on RUM are rare in public hacktivity. The pattern is "Cognito identity pool over-permission via embedded SDK" — RUM is one common embedding.
Andres Riancho — "Misconfigured Cognito Identity Pools" (2020/2023) — establishes the attack class. andresriancho.com
Rhino Security Labs — Pacu cognito__enum_identity_pools — production tooling that automates Chain A. github.com/RhinoSecurityLabs/pacu
NotSoSecure / Claranet — "Exploiting weak configurations in Amazon Cognito" (Nov 2023) — explicitly calls out RUM as one of three SDKs commonly leaking the pool ID. notsosecure.com
Run aws sts get-caller-identity and screenshot the role ARN.
Run enumerate-iam / Pacu iam__enum_permissions — capture at least one allowed action beyond rum:PutRumEvents. Without this, the finding is Informational.
Demonstrate at least one read/list against a real resource (S3 bucket list, DynamoDB scan, Lambda invoke).
Do not modify/delete data even if permitted — read-only PoC only.
S3 bucket listing without read access — finding a listable bucket is recon, not a vulnerability. Need to demonstrate readable objects with sensitive content.
Firebase public read without sensitive data — an open Firebase RTDB with only public app config is informational. Need PII, credentials, or internal data.
GCP/Azure storage without credential impact — public blob storage containing static assets is not a finding. Need secrets, source code, or customer data.
Cloud metadata endpoint accessible from outside — SSRF to 192.0.2.1 is only exploitable from inside the cloud. External access to metadata is a different (and more severe) finding.
Bucket ACL misconfig vs policy misconfig — bucket policies and ACLs are different mechanisms. Test both before concluding the bucket is public.
CloudFront/Cloudflare CDN origin leakage — bypassing CDN to reach the origin is recon until you demonstrate what's different (debug endpoints, auth-less access).
Unrestricted cloud function triggers — publicly-invokable functions may be intentional. Need to demonstrate the function does something sensitive (data access, resource modification).
Related Skills & Chains
hunt-subdomain — Stale CNAMEs pointing to deleted buckets are a takeover gold mine. Chain primitive: Cloud misconfig (S3 public/deleted) + hunt-subdomain → unclaimed CNAME points to bucket → assets.target.com takeover.
cloud-iam-deep — A leaked SA JSON / AWS key in a public bucket is only half the bug. Chain primitive: Public S3 + leaked AWS key in .env → cloud-iam-deep enumeration → cross-service iam:PassRole escalation.
hunt-ssrf — Metadata service is reachable only from inside the VPC; SSRF is the bridge. Chain primitive: SSRF + cloud misconfig (IMDSv1 still enabled) → instance role keys → S3/RDS data read.
supply-chain-attack-recon — Exposed CI/CD endpoints and SBOMs reveal internal package names. Chain primitive: Exposed Jenkins/GitLab + internal package name leak → npm/PyPI dependency-confusion publish → CI build pwn.
security-arsenal — Load the Cloud Bucket Wordlist (target-prod / target-backup / target-staging permutations) and the Admin-Panel Path List for fast enumeration.
triage-validation — Apply the Unique-Marker gate: any "writable bucket" claim requires a write of a unique marker file and a read-back from a clean session before report submission.
