2026-09-20 –, Tesla
Your bug bounty / pentest scope is a list of ASN and domains. Your attack surface isn't.
Modern cloud architectures expand beyond those horizons - Lambda function URLs, API Gateway endpoints, S3 buckets, CloudFront distributions, container registries, and CI artifacts deploy outside the visible domain space, weakly monitored and missing from official scope.
So: whoarethey? This talk provides the answers to that key question - how to map a target company's cloud-heavy infrastructure with a pure black-box approach, beyond standard methods. Alongside a brief recap of the regular recon (acquisitions, subdomain enumeration) for completeness, the focus will be on cloud-asset recon. You will learn how to find all the APIs of any given cloud and almost all the cloud domains with user workloads or content - and how to attribute them to a specific company.
For hunters and pentesters tired of running the same methods against the same scope with the same results and wondering where the bugs went.
Why this talk
The cloud is now where the S&P 500 lives. Statistics indicate that 99% of customer security failures in clouds are due to the errors of the customers themselves, and HackerOne reported all-time-high vulnerability submissions in March 2026.
While the underlying sources – a list of subdomains and ASN ranges – are still the same as five years ago, the recon methodology most hunters use has just added an AI layer on top. Cloud-native targets live one layer past that list, and the standard tooling doesn't reach them.
Anatomy of cloud assets
The shape of a modern cloud footprint. For each major service, I cover the URL and endpoint patterns that let you fingerprint it from outside:
- Service example – Storage, bucket URL patterns across multiple providers (virtual-hosted-style vs path-style; regional variants)
- Service example – Serverless / Functions, Lambda URL formats, function-URL patterns, container-based functions
- Service example – Identity / Cognito, pool URLs and the public auth-flow surface (SignUp, ConfirmSignUp, InitiateAuth, RespondToAuthChallenge, ForgotPassword, DescribeUserPoolClient, GetUser, UpdateUserAttributes)
- How to find APIs for ALL! cloud services via hardcoded endpoints in SDKs (e.g., boto3 / botocore endpoints data)
- How to find MANY cloud domains with user content via the Public Suffix List
Discovery and exploitation
Three lenses, layered on top of each other:
- Company assets (the regular recon) - acquisitions via Tracxn and Crunchbase, legal entities, ASN ranges via BGP.HE.NET and ASNmap, second-level domains, subdomain enumeration with PureDNS, DNSx, Katana, CSPrecon. Treated as substantive content, not a one-slide intro.
- Cloud assets - what each provider exposes by default and how to fingerprint a service from the patterns covered in section 1.
- Company in cloud (the intersection) - pairing the regular recon output with cloud patterns to land on the actual targets: xyz.s3, xyz.lambda-url, xyz.cloudfront, Cognito pools tied to a company's identity domain.
Approach taxonomy. Passive → safe-active → noisy-active across providers, and when each is appropriate.
Attribution. The core of the talk: attributing arbitrary cloud assets to a specific company through TLS certificates (TLSx), link graphs in HTML and JS, copyright and contact strings in serialized configs, and the data-leakage tells in exposed JSON/XML. Includes a note on where invasive attribution methods cross ethical lines. Which data sources and tools fit attribution, and how to use each.
Tooling and how integrate them to methodology
- Shodan facet analysis
- ZoomEye
- GitHub search
- TLSx
- Cloud-SNI ranges (ec2-reachability.amazonaws.com, kaeferjaeger.gay)
- PureDNS
- DNSx
- Katana
- CSPrecon
- Wayback CDX API for wildcard searches
- Postman public collections
- Wordlists from Assetnote, plus target-specific lists from HTML, BigQuery, FFUF/Intruder
- S3Scanner (buckets)
- Pacu (IAM bruteforce, Lambda enum, Cognito flows)
Defense and hardening - "Attack yourself first"
- Wildcard bug bounty scope (catch-all by default)
- Stay on top of trends; assume scope drifts
- Continuous attack-surface inventory
- Manual recon at least annually
- Treat staging as prod
- Billing alerts on every account
- Acquisition onboarding SLA
- Service-account chain analysis
- Whitebox inventory
- Stealer-log monitoring
- Incremental / per-release audits
References
I'm a security engineer, pentester, and researcher who came to the field from a background in medicine. I've been hacking the web since 2019 and hold OSCP and OSWE
Happy to contribute to the community and exchange knowledge - come say hi, let's chat and stay in touch