123 lines
2.8 KiB
Markdown
123 lines
2.8 KiB
Markdown
|
# Insecure Interfaces and APIs (For Cloud)
|
||
|
|
|
||
|
|
### Method 1
|
||
|
|
|
||
|
|
```bash
|
||
|
|
python3 cloudhunter.py --write-test --open-only http://example.com
|
||
|
|
```
|
||
|
|
|
||
|
|
* `--write-test`: This option tells the script to write a test file. The purpose and content of the test file would depend on the implementation of the [cloudhunter.py script](https://github.com/belane/CloudHunter).
|
||
|
|
* `--open-only`: This option specifies that the script should only check for open ports or services on the target URL, which in this case is http://example.com. It indicates that the script will not attempt to perform any other type of scanning or analysis.
|
||
|
|
* `http://example.com`: This is the target URL that the script will perform the open port check on. In this example, it is set to http://example.com, but in a real scenario, you would typically replace it with the actual URL you want to test.
|
||
|
|
|
||
|
|
|
||
|
|
### Method 2
|
||
|
|
|
||
|
|
```bash
|
||
|
|
cf enum <domain>
|
||
|
|
```
|
||
|
|
|
||
|
|
* By replacing `<domain>` with an actual domain name, the command would attempt to retrieve information specific to that domain using the cf enum tool. The details of what kind of information is gathered and how it is presented would depend on the specific implementation of the tool being used.
|
||
|
|
|
||
|
|
|
||
|
|
### Method 3
|
||
|
|
|
||
|
|
```bash
|
||
|
|
ffuf -w /path/to/seclists/Discovery/Web-Content/api.txt -u https://example.com/FUZZ -mc all
|
||
|
|
```
|
||
|
|
|
||
|
|
* `ffuf`: This is the name of the tool or command being executed.
|
||
|
|
* `-w /path/to/seclists/Discovery/Web-Content/api.txt`: This option specifies the wordlist (-w) to be used for fuzzing. The wordlist file, located at /path/to/seclists/Discovery/Web-Content/api.txt, contains a list of potential input values or payloads that will be tested against the target URL.
|
||
|
|
* `-u https://example.com/FUZZ`: This option defines the target URL (-u) for the fuzzing process. The string FUZZ acts as a placeholder that will be replaced by the values from the wordlist during the fuzzing process. In this case, the target URL is https://example.com/FUZZ, where FUZZ will be substituted with different payloads from the wordlist.
|
||
|
|
* `-mc all`: This option specifies the match condition (-mc) for the responses received from the target server. In this case, all indicates that all responses, regardless of the HTTP status code, will be considered as valid matches.
|
||
|
|
|
||
|
|
|
||
|
|
### Method 4
|
||
|
|
|
||
|
|
```bash
|
||
|
|
php s3-buckets-bruteforcer.php --bucket gwen001-test002
|
||
|
|
```
|
||
|
|
|
||
|
|
* By providing the `--bucket` parameter followed by a specific value (gwen001-test002), the [script](https://github.com/gwen001/s3-buckets-finder/tree/master) will attempt to brute-force the Amazon S3 buckets using that particular value as the target. The script likely includes logic to iterate through different bucket names, trying each one until a valid or accessible bucket is found.
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|