/cloud-saas-exposure

name: cloud-saas-exposure
description: "Organization-grade cloud and supply-chain attack-surface discovery: S3/GCS/Azure Blob bucket discovery via observed-name mining (CNAME/cert-SAN/Wayback) and bounded two-class permutation (6 prefixes x 15 suffixes on trusted tokens, bounded target-bound expansion on subdomain stems), existence (HEAD/GET) vs public-listing confirmation, object-key triage into 9 value tiers (database dumps, credentials, IaC state, kubeconfig, VCS dirs, config, archives, PII, logs), dangling-CNAME bucket-takeover detection, and the ownership-gated severity model that stops an unattributable public bucket from becoming a false CRITICAL; the fully offline AWS-account-ID recovery from a leaked AKIA/ASIA/AROA access key (base32 decode, runnable stdlib Python, canonical test vector, AWS-documentation-example-ID screening); dependency-confusion confirmation for npm/PyPI (internal-signal classifier -- private-registry binding vs org-namespace match -- paired with a read-only public-registry 404 check and the npm scope-claimability nuance the public search API misses); and passive cloud-native/container/Kubernetes/CI control-plane fingerprinting (Lambda URLs, API Gateway, Cloud Run, App Service, kubelet/etcd/K8s API/dashboard, Jenkins/GitLab/Argo CD) as an org-attribution and exposure surface. Passive/discovery only -- no exploitation, no credential submission, no active control-plane confirmation (a stage-6 validate_cloud active tier is described but out of scope). Use when enumerating a target's cloud storage footprint, recovering an AWS account ID from a leaked key, confirming a supply-chain dependency-confusion vector, or fingerprinting cloud-native/K8s/CI infrastructure for an authorized external recon engagement."
version: 1.0
triggers:
  - cloud attack surface
  - cloud exposure
  - SaaS exposure
  - cloud bucket enumeration
  - S3 bucket enum
  - GCS bucket enum
  - Azure blob enum
  - bucket takeover
  - dangling CNAME bucket
  - public cloud bucket
  - listable bucket
  - bucket ownership
  - object storage exposure
  - bucket permutation
  - AWS account ID
  - AWS account ID from access key
  - AKIA decode
  - access key account ID
  - offline AWS decode
  - base32 AWS account
  - AWS account enumeration
  - cross-account trust
  - IAM role phishing
  - sts assume role
  - dependency confusion
  - npm dependency confusion
  - PyPI dependency confusion
  - supply chain attack surface
  - unclaimed package
  - internal package registry
  - private npm registry
  - scoped npm package
  - npm scope claimability
  - package registry leak
  - cloud native fingerprint
  - Lambda function URL
  - API Gateway exposure
  - Cloud Run exposure
  - App Service exposure
  - serverless exposure
  - Kubernetes exposure
  - K8s exposure
  - kubelet exposure
  - etcd exposure
  - Docker API exposure
  - CI CD exposure
  - Jenkins exposure
  - GitLab exposure
  - control plane exposure
  - cloud footprint
  - cloud account attribution

Cloud & SaaS Exposure — Buckets, Offline AWS Account-ID Recovery, Dependency Confusion, and Cloud-Native/K8s Fingerprinting

> Companion skills: `osint-methodology` (the pipeline this plugs into — Stage 2 asset > expansion, Stage 4 exposure analysis, Stage 5 supply-chain confirmation). `offensive-osint` > §16.8 (bucket-permutation raw wordlist), §16.17 (cloud-native URL pattern table), §16.18– > §16.19 (container/K8s/CI paths + active curl recipes), §44 (package-registry search). This > skill does not repeat those lists — it builds the reasoning layer on top: the > ownership-gated bucket severity model, the offline AKIA→account-ID decode, the > dependency-confusion two-part confirmation contract, and cloud-native/K8s as an > org-attribution surface, not just another probe list.

0. When to Use / When NOT

**Use this skill when:** you're mapping an authorized target's cloud and supply-chain footprint — enumerating storage buckets and judging whether a hit is actually the target's risk (not a stranger's public bucket that happens to match a permutation); recovering the AWS account ID behind a leaked access key you already hold (dead or live); confirming whether an internal-looking npm/PyPI dependency is a registerable supply-chain vector; or fingerprinting cloud-native (Lambda/Cloud Run/App Service/…) and container/K8s/CI control-plane surface for org attribution and exposure triage.

**Do NOT use this skill when:** you just need the raw bucket-permutation wordlist, cloud-native URL pattern table, or container/K8s/CI path list with no reasoning layer — go straight to `offensive-osint` §16.8/§16.17–16.19/§44. Do NOT use it for anything past discovery/confirmation: registering an unclaimed package, submitting AWS credentials, authenticating to a Kubernetes API, or confirming a fingerprinted control plane actually answers unauthenticated (that's a stage-6 `--validate --validate-cloud` active tier — described, never performed, §5/§9.4).

---

1. Authorization & Legal Posture

Reuses `osint-methodology` §1 — assets you own or have written authorization to assess. Three of this skill's four subsystems carry a distinct authorization shape, worth being explicit about before you run any of them:

• **Bucket probing (§6)** is a real HTTP GET against bucket infrastructure that may or may

not be the target's — the same "active but low-intrusion" tier as any other GET against target-adjacent infra. Standard engagement authorization applies.

• **AWS account-ID decode (§7)** is fully offline. No authorization question beyond already

lawfully holding the leaked key.

• **Dependency-confusion confirmation (§8)** issues live GETs, but only against the public

npm/PyPI registries — **zero packets to the target**. This is why it's explicitly in scope even though it's "active."

• **Cloud-native/K8s/CI fingerprinting (§9)** is pattern-matching over hostnames and ports

already resolved by earlier recon — no new network traffic of its own.

---

2. C