| name | hunt-cloud |
| description | Cloud attack hunting for AWS / Azure / GCP - credential discovery, metadata SSRF, IAM privesc, service enumeration, persistence. Scope + billing aware. Wiki-first, FIND schema output. |
Hunt: Cloud (AWS / Azure / GCP)
Assumes hunt-core for the scope gate, two-account rule, confirmation gate, enumeration limits, stop conditions, wiki protocol, FIND output, and Deadends. Do not re-derive any of that here.
Wiki
qmd_query "cloud AWS Azure GCP metadata SSRF IAM privilege escalation credential discovery persistence" via wiki-search MCP
Hub: [[cloud-moc]] (live index). Primary page: [[cloud-iam-attacks]]. Payload arsenal: wiki/payloads/imds-cloud-metadata.md.
Anchors: [[aws-metadata-ssrf]] (SSRF -> IMDS creds), [[azure-ad-iam]].
Billing and safety (cloud-specific)
hunt-core owns the scope gate. Cloud stacks three specifics on top of it:
- Scope is account / subscription / project IDs, not just hostnames. Confirm the ID is in scope before the first authenticated call.
- Every call is billed and logged (CloudTrail / Azure Activity / GCP Audit Logs). Enumeration is loud, costs the client, and mass API calls trip provider abuse detection (GuardDuty / Defender). Prefer read-only enumeration, keep call volume low, and create or delete NOTHING without RoE sign-off.
- Never spray IAM users (lockout + GuardDuty). Reuse keys from
loot.md first.
Attack surface (ranked)
- Metadata SSRF - an app-side SSRF reaching
169.254.169.254 / metadata.google.internal hands you instance/managed-identity creds. Highest-value chain.
- Exposed keys -
.env, ~/.aws/credentials, CI/CD vars, JS bundles, git history: / (AWS), (Azure), JSON (GCP).
