Your bug bounty / pentest scope is a list of ASN and domains. Your attack surface isn't.
Modern cloud architectures expand beyond those horizons - Lambda function URLs, API Gateway endpoints, S3 buckets, CloudFront distributions, container registries, and CI artifacts deploy outside the visible domain space, weakly monitored and missing from official scope.
So: whoarethey? This talk provides the answers to that key question - how to map a target company's cloud-heavy infrastructure with a pure black-box approach, beyond standard methods. Alongside a brief recap of the regular recon (acquisitions, subdomain enumeration) for completeness, the focus will be on cloud-asset recon. You will learn how to find all the APIs of any given cloud and almost all the cloud domains with user workloads or content - and how to attribute them to a specific company.
For hunters and pentesters tired of running the same methods against the same scope with the same results and wondering where the bugs went.
BalCCon2k26 premiere - original content, slides prepared specifically for this conference, no prior public delivery. Working draft: https://drive.google.com/file/d/1K7P6L3y62gsj9c6OFnLwx1_sQxXJcOAg/view?usp=sharing
Happy to incorporate reviewer feedback during the review window.
Why this talk
The cloud is now where the S&P 500 lives. Statistics indicate that 99% of customer security failures in clouds are due to the errors of the customers themselves, and HackerOne reported all-time-high vulnerability submissions in March 2026.
While the underlying sources – a list of subdomains and ASN ranges – are still the same as five years ago, the recon methodology most hunters use has just added an AI layer on top. Cloud-native targets live one layer past that list, and the standard tooling doesn't reach them.
Anatomy of cloud assets
The shape of a modern cloud footprint. For each major service, I cover the URL and endpoint patterns that let you fingerprint it from outside:
- Service example – Storage, bucket URL patterns across multiple providers (virtual-hosted-style vs path-style; regional variants)
- Service example – Serverless / Functions, Lambda URL formats, function-URL patterns, container-based functions
- Service example – Identity / Cognito, pool URLs and the public auth-flow surface (SignUp, ConfirmSignUp, InitiateAuth, RespondToAuthChallenge, ForgotPassword, DescribeUserPoolClient, GetUser, UpdateUserAttributes)
- How to find APIs for ALL! cloud services via hardcoded endpoints in SDKs (e.g., boto3 / botocore endpoints data)
- How to find MANY cloud domains with user content via the Public Suffix List
Discovery and exploitation
Three lenses, layered on top of each other:
- Company assets (the regular recon) - acquisitions via Tracxn and Crunchbase, legal entities, ASN ranges via BGP.HE.NET and ASNmap, second-level domains, subdomain enumeration with PureDNS, DNSx, Katana, CSPrecon. Treated as substantive content, not a one-slide intro.
- Cloud assets - what each provider exposes by default and how to fingerprint a service from the patterns covered in section 1.
- Company in cloud (the intersection) - pairing the regular recon output with cloud patterns to land on the actual targets: xyz.s3, xyz.lambda-url, xyz.cloudfront, Cognito pools tied to a company's identity domain.
Approach taxonomy. Passive → safe-active → noisy-active across providers, and when each is appropriate.
Attribution. The core of the talk: attributing arbitrary cloud assets to a specific company through TLS certificates (TLSx), link graphs in HTML and JS, copyright and contact strings in serialized configs, and the data-leakage tells in exposed JSON/XML. Includes a note on where invasive attribution methods cross ethical lines. Which data sources and tools fit attribution, and how to use each.
Tooling and how integrate them to methodology
- Shodan facet analysis
- ZoomEye
- GitHub search
- TLSx
- Cloud-SNI ranges (ec2-reachability.amazonaws.com, kaeferjaeger.gay)
- PureDNS
- DNSx
- Katana
- CSPrecon
- Wayback CDX API for wildcard searches
- Postman public collections
- Wordlists from Assetnote, plus target-specific lists from HTML, BigQuery, FFUF/Intruder
- S3Scanner (buckets)
- Pacu (IAM bruteforce, Lambda enum, Cognito flows)
Defense and hardening - "Attack yourself first"
- Wildcard bug bounty scope (catch-all by default)
- Stay on top of trends; assume scope drifts
- Continuous attack-surface inventory
- Manual recon at least annually
- Treat staging as prod
- Billing alerts on every account
- Acquisition onboarding SLA
- Service-account chain analysis
- Whitebox inventory
- Stealer-log monitoring
- Incremental / per-release audits