Let's be honest, enumerating cloud environments sucks compared to Active Directory. You can't just fire up BloodHound, run some LDAP queries, and call it a day. I mean, you can, but not for all cloud providers. Cloud providers actually thought about security (shocking, I know), so they locked down enumeration behind, or at least made it harder, through permission whitelisting. In cloud, most of the times, a permission is given to an identity with no permission to begin with. This works differently from an environment like Active Directory, where by default, an identity will have access to list resources, unless specifically prevented.

But here's the thing: cloud platforms are massive, with tons of public-facing services, weird API behaviors, and features that absolutely nobody asked for but are somehow perfect for reconnaissance. This workshop is all about finding those weird gaps and abusing the hell out of them.

Before you even have creds, there's actually a ton you can do. Want to know what services a target is using? Look at what IP or DNS endpoint the services have. Cloud provider split services by IP ranges, so it's easy to find what service is hosted, just by the IP it uses. Want to validate if someone works at a company? Azure's got you covered with some fun unauthenticated user fuzzing. Need to know if an AWS account exists? Just find a public S3 buckets they control and bruteforce the account name. GCP literally tells you if a user exists through UI error messages (thanks Google!). We'll walk through all the pre-auth tricks across AWS, Azure, and GCP that let you build a surprisingly detailed map of your target before you even attempt to get in.

Once you're inside though, that's when things get really interesting. Most people think you need crazy permissions to enumerate a cloud environment, but that's not true if you know where to look. Resource tags? Goldmine. CloudTrail logs? Even better! It's like reading someone's diary of every daily activity. And don't even get me started on AWS CloudControl API, which is basically a "break all the detection rules" button that lets you enumerate resources while looking totally legitimate. We'll go hands-on with all of this, showing you how to bruteforce resource names, abuse default permissions, and generally be a pain in the ass to defenders.