Skip to main content

​
Overview

The Cloud Scanner identifies misconfigurations and vulnerabilities in cloud environments, focusing on AWS S3 buckets and Google Cloud Storage. It detects public access issues, overly permissive configurations, and interesting files that may expose sensitive data. The Cloud Scanner is a vulnerability scanner: it actively tests cloud resources for security weaknesses. It does not add data to your Attack Surface. Identified vulnerabilities are reported as findings.

​
Supported targets

​
Cloud storage URLs

You can scan cloud storage buckets directly using their URLs:

​
Supported cloud providers

​
Scan options

The Cloud Scanner has two configurable options (both enabled by default):
If “Detect cloud provider” is disabled, the scanner tests for vulnerabilities across all supported providers. If enabled, it only tests for issues specific to the detected provider.

​
What it detects

​
AWS S3

​
Google Cloud Storage

​
How it works

The Cloud Scanner performs these steps:
  1. Target resolution: Resolves the target to an IP address
  2. Provider detection: Checks IP ranges to identify AWS, GCP, or Azure
  3. Bucket discovery: Identifies storage buckets from the target
  4. Permission testing: Tests what operations are allowed (read, write, list)
  5. Configuration analysis: Checks security settings like ACLs, IAM policies, encryption
  6. Interesting file search: Looks for sensitive filenames in accessible buckets

​
Follow-up actions

After discovering cloud misconfigurations:
  • Restrict public access: Remove allUsers and allAuthenticatedUsers permissions
  • Enable bucket-level security: Use uniform bucket-level access (GCP) or block public access (AWS)
  • Enable logging: Track access to sensitive buckets
  • Review sensitive files: Check if exposed files contain credentials or PII
  • Run Network Scanner: Test the underlying infrastructure
  • Run Subdomain Finder: Discover additional cloud-hosted assets