메뉴
Cloud-native service fingerprints, Kubernetes/container exposure, CI/CD platform exposure, TLS deep audit, and favicon hash pivot for authorized infrastructure recon.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
| name | cloud-and-infra |
| description | Cloud-native service fingerprints, Kubernetes/container exposure, CI/CD platform exposure, TLS deep audit, and favicon hash pivot for authorized infrastructure recon. |
| version | 1.1.0 |
| triggers | ["cloud native fingerprint","Lambda function URL","Cloud Run","kubernetes exposure","kubelet","etcd","CI CD exposure","Jenkins recon","GitLab self-hosted","GitHub Actions secrets","TLS deep audit","JA3 JA4","container registry","Docker API","Argo CD","favicon hash"] |
Sub-skill of
offensive-osint. Loadosint-methodologyfor pipeline and triage context. Authorized targets only.
When triggered: Cloud-native service fingerprinting, Kubernetes/container exposure, CI/CD platform exposure, TLS deep audit, or container registry leak hunting is needed.
Execute:
osint-methodology §3 schema.Output: Infrastructure findings with provider, service type, auth posture, severity. All per osint-methodology §3 schema.
Severity rules: Inline per section tables. Docker API unencrypted = CRITICAL. Open kubelet = CRITICAL. Open etcd = CRITICAL. K8s API anonymous = HIGH. TLS 1.0/1.1 = MEDIUM.
Gating rules: Active port probing is HIGH detectability — confirm authorization. Container image pulls generate logs — note detectability.
Chain to: Feed discovered cloud endpoints to web-surface for HTTP checks. Feed K8s findings to analysis-and-reporting for attack-path hints. For ASN/BGP lookups, use recon-asset-discovery.
| Provider | URL pattern | Notes |
|---|---|---|
| AWS Lambda Function URL | *.lambda-url.<region>.on.aws | Direct invocation; check IAM auth posture |
| AWS App Runner | *.<region>.awsapprunner.com | Managed container |
| AWS API Gateway | *.execute-api.<region>.amazonaws.com | REST/HTTP/WebSocket; check authorizer |
| AWS CloudFront | d{14}\.cloudfront\.net | Distribution; find origin via docs/methods/cdn-bypass-techniques.md |
| AWS ALB / ELB | *.elb.<region>.amazonaws.com | Behind = EC2 / ECS |
| AWS Amplify | *.amplifyapp.com | Static + Lambda backend |
| Google Cloud Run | *.run.app (and *.<region>.run.app) | Check public-vs-IAM auth |
| Google Cloud Functions | *.cloudfunctions.net | Serverless |
| Google App Engine | *.appspot.com | Older serverless |
| Azure Functions | *.azurewebsites.net | Function App; also App Service |
| Azure Container Apps | *.azurecontainerapps.io | Containers |
| Vercel | *.vercel.app, *.now.sh (legacy) | Frontend + serverless |
| Netlify | *.netlify.app, *.netlify.com | Frontend + functions |
| Cloudflare Workers | *.workers.dev | Edge functions |
| Cloudflare Pages | *.pages.dev | Static + functions |
| Heroku | *.herokuapp.com | Dynos |
| Render | *.onrender.com | Container/static |
| Railway | *.railway.app | App platform |
| DigitalOcean App Platform | *.ondigitalocean.app | Static + container |
Per-platform checks:
/api/*; enumerate via JS extraction.| Target | Port | Probe | Severity |
|---|---|---|---|
| Docker API (unencrypted) | 2375 | curl -sk -m 5 http://${IP}:2375/v1.40/info | CRITICAL |
| Docker API (TLS) | 2376 | curl -sk -m 5 https://${IP}:2376/v1.40/info | HIGH |
| Kubernetes API server | 6443 / 8443 | curl -sk -m 5 https://${IP}:6443/api | HIGH if anonymous non-403 |
| kubelet | 10250 (HTTPS) | curl -sk -m 5 https://${IP}:10250/pods | CRITICAL (no auth = pod exec) |
| etcd | 2379 (client) | curl -sk -m 5 https://${IP}:2379/v2/keys/ | CRITICAL (cluster state + secrets) |
| Kubernetes Dashboard | 8001 / 9090 / 30000+ | curl -sk -m 5 http://${IP}:8001/api/v1/namespaces/kube-system/services/kubernetes-dashboard | HIGH |
| kube-controller-manager | 10257 | curl https://${IP}:10257/metrics | MEDIUM |
| kube-scheduler | 10259 | curl https://${IP}:10259/metrics | MEDIUM |
| Helm Tiller (Helm 2, deprecated but found) | 44134 | helm --host ${IP}:44134 list | HIGH |
Container registries to check for leaks:
| Registry | Search pattern |
|---|---|
| Docker Hub | https://hub.docker.com/search?q=<target-keyword>&type=image |
| Quay (Red Hat) | https://quay.io/search?q=<target-keyword> |
| GitHub Container Registry | https://api.github.com/orgs/<org>/packages?package_type=container |
| Amazon ECR Public | https://gallery.ecr.aws/?searchTerm=<keyword> |
| Google Container Registry (GCR) | https://gcr.io/v2/<project-id>/tags/list (also try us.gcr.io, eu.gcr.io, asia.gcr.io) |
| Azure Container Registry (ACR) | https://<registry>.azurecr.io/v2/_catalog (anonymous pull if enabled) |
Per-image scan workflow:
docker pull <registry>/<image>:<tag>
docker save <image> -o /tmp/img.tar
# Extract layers; run secret catalog over files
docker history <image> # inspect build args + COPY of secrets
| Platform | Common exposure | Probe |
|---|---|---|
| Jenkins | /script (Groovy console = RCE if no auth), /asynchPeople/ | curl -sk -m 10 "${T}/script" |
| GitLab self-hosted | Version in HTML; /api/v4/version | curl -sk -m 10 "${T}/api/v4/version" |
| TeamCity | /login.html; CVE-2024-27198 (KEV) | curl -sk -m 10 "${T}/login.html" | grep -i TeamCity |
| Argo CD | /api/version; anonymous-auth posture | curl -sk -m 10 "${T}/api/version" |
| Bamboo | /rest/api/latest/info | curl -sk -m 10 "${T}/rest/api/latest/info" |
| Drone CI | /api/info | curl -sk -m 10 "${T}/api/info" |
| Spinnaker | /gate/info, /applications | curl -sk -m 10 "${T}/gate/info" |
| CircleCI | /api/v2/me (token leak → project enum), public build logs | curl -sk -m 10 "${T}/api/v2/me" -H "Circle-Token: ${TOKEN}" |
GitHub Actions secret-leak anti-patterns:
# Anti-pattern: secret echoed to log
run: echo "${{ secrets.MY_API_KEY }}"
# Anti-pattern: pull_request_target with fork code checkout (CVE class)
on: pull_request_target
jobs:
test:
steps:
- uses: actions/checkout@v3
with:
ref: ${{ github.event.pull_request.head.sha }} # checks out fork code with secrets in env
Beyond cert SAN + JARM — inspect cipher suites, protocols, and config quality.
# sslyze (most thorough — install: see docs/reference/tooling-install.md)
sslyze --regular target.example:443
sslyze --json_out=tls.json target.example:443
# testssl.sh (thorough + readable)
docker run --rm -ti drwetter/testssl.sh https://target.example
testssl.sh --jsonfile-pretty=tls-report.json target.example:443
# nmap (lighter)
nmap --script ssl-enum-ciphers,ssl-cert -p 443 target.example
Issues to check:
| Issue | Severity |
|---|---|
| TLS 1.0 / 1.1 supported | MEDIUM (PCI-DSS forbids TLS 1.0) |
| SSL 3.0 / 2.0 supported | HIGH |
| Weak ciphers (RC4, 3DES, CBC modes) | MEDIUM |
| Anonymous DH | HIGH |
| Weak key size (<2048 RSA, <256 ECDSA) | HIGH |
| Heartbleed (CVE-2014-0160) | CRITICAL |
| ROBOT (CVE-2017-13099) | HIGH |
| Ticketbleed (CVE-2016-9244) | HIGH (F5-specific) |
| HSTS not present on /login | HIGH |
| Self-signed cert on production | MEDIUM |
| Expired cert | MEDIUM |
JA3/JA4 reference databases:
ssl.jarm:<hash> to find shared infrastructure / origin candidates.python3 -c "
import urllib.request, codecs, mmh3
data = urllib.request.urlopen('https://target.example/favicon.ico').read()
print(mmh3.hash(codecs.encode(data, 'base64')))"
shodan search "http.favicon.hash:<hash>" --fields ip_str,port,org
Note: For ASN/BGP and internet measurement, see
recon-asset-discovery. For reverse DNS sweep and IPv6 enumeration scripts, seedocs/methods/active-sweep-scripts.md.
Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the 5-stage recon pipeline, asset-graph discipline, severity rubric, confidence upgrade workflows, time budgeting, identity-fabric mapping, breach×identity correlation, detectability tagging, detection-aware probing, WAF/CDN bypass, vulnerability prioritization, phishing infrastructure planning, bug bounty submission, and client deliverable templates. Use when planning or executing reconnaissance against authorized targets, mapping an organization's external attack surface, investigating a person/entity, or producing client deliverables.
Subdomain enumeration, CT logs, DNS record catalog, WHOIS/RDAP, and passive reconnaissance for authorized external recon.
Probe paths, endpoint scoring, email security analysis, vendor fingerprints, documentation leak hunting, and API endpoint references for authorized web-surface enumeration.
Endpoint interest scoring (0–100), mobile app ownership confidence, attack-path hint patterns (35 templates), severity decision matrix (92 examples), sector severity overrides, and sidecar coordination.
Concrete endpoints, probes, and enumeration techniques for identity provider fingerprinting and auth surface mapping. Covers Microsoft Entra (Azure AD), Okta, ADFS, Google Workspace, generic OIDC (Keycloak/Auth0/Ping/OneLogin/Duo), SAML metadata, AWS account-ID extraction, Microsoft 365 deep enumeration (Teams/SharePoint/OneDrive/OAuth/Power Platform), GraphQL field-suggestion enumeration when introspection is disabled, and LinkedIn employee enumeration with role prioritization. Use when mapping an org's auth architecture, enumerating SSO/IdP surfaces, or building a target employee list.
Router for the Offensive OSINT arsenal. Dispatches to focused sub-skills by task type. Covers the full external red-team surface: asset discovery, web enumeration, identity/SSO, secrets/dorks, post-credential workflows, cloud/infra, people/breach intel, and analysis/reporting. Companion to osint-methodology. Use for any authorized external recon, bug bounty, or ASM engagement.