Lab 02 — Cloud Reconnaissance
Lab Information
Section titled “Lab Information”| Item | Details |
|---|---|
| Lab ID | CPS-LAB-002 |
| Difficulty | Beginner |
| Duration | 2 Hours |
| Cloud Provider | AWS (Primary) |
| Tools Required | AWS CLI, Amass, Subfinder, Nmap, dig, nslookup, crt.sh, whois, curl |
| Estimated Cost | Free |
Lab Overview
Section titled “Lab Overview”Reconnaissance is the first stage of every professional penetration test.
Before attempting to assess cloud infrastructure, security consultants identify publicly accessible assets, cloud-hosted services, exposed APIs and internet-facing applications.
In this lab, you will perform reconnaissance against a simulated enterprise cloud environment using safe and authorized techniques.
This is exactly how cloud penetration testers begin enterprise engagements.
Learning Objectives
Section titled “Learning Objectives”After completing this lab, you will be able to:
- Perform passive reconnaissance.
- Perform active reconnaissance.
- Identify cloud-hosted infrastructure.
- Discover publicly exposed cloud assets.
- Enumerate DNS information.
- Identify cloud technologies.
- Build an attack surface map.
Enterprise Scenario
Section titled “Enterprise Scenario”CloudNova Technologies has been hired to perform an external cloud penetration test for FinSecure Bank.
The customer has approved reconnaissance against:
- Public Website
- DNS Records
- Cloud Endpoints
- Internet-facing APIs
- Public Cloud Resources
Your objective is to identify as much information as possible before moving into enumeration.
Lab Architecture
Section titled “Lab Architecture” Internet │ │ ┌────────────────────────┐ │ Public DNS Records │ └────────────┬───────────┘ │ CloudFront │ ┌─────────────┴─────────────┐ │ │ Web Portal Public API │ │ └─────────────┬─────────────┘ │ AWS ResourcesLab Prerequisites
Section titled “Lab Prerequisites”Complete:
- Lab 01 — Build Your Cloud Pentesting Lab
Verify tools:
- AWS CLI
- dig
- nslookup
- curl
- nmap
- whois
Optional:
- Amass
- Subfinder
Mission 1 — Verify Internet Connectivity
Section titled “Mission 1 — Verify Internet Connectivity”Run:
ping google.comExpected Output
64 bytes from...Mission 2 — Identify DNS Records
Section titled “Mission 2 — Identify DNS Records”Use:
dig example.comor
nslookup example.comObserve:
- A Records
- Name Servers
- MX Records
Mission 3 — Perform WHOIS Lookup
Section titled “Mission 3 — Perform WHOIS Lookup”Run:
whois example.comIdentify:
- Registrar
- Registration Date
- Name Servers
Mission 4 — Discover Subdomains
Section titled “Mission 4 — Discover Subdomains”Passive enumeration:
amass enum -passive -d example.comAlternative:
subfinder -d example.comRecord every discovered subdomain.
Mission 5 — Certificate Transparency Search
Section titled “Mission 5 — Certificate Transparency Search”Visit:
https://crt.shSearch:
example.comRecord:
- Subdomains
- Certificates
- Issuing CA
Mission 6 — Identify Cloud Provider
Section titled “Mission 6 — Identify Cloud Provider”Run:
curl -I https://example.comReview response headers.
Look for:
- CloudFront
- Amazon
- Azure
- Akamai
Mission 7 — Enumerate HTTP Headers
Section titled “Mission 7 — Enumerate HTTP Headers”Run:
curl -I https://example.comReview:
- Server
- X-Powered-By
- Security Headers
- Cache Headers
Mission 8 — Identify Public Services
Section titled “Mission 8 — Identify Public Services”Scan approved ports.
nmap example.comExample output:
80/tcp
443/tcpDocument:
- HTTP
- HTTPS
- SSH
- SMTP
Only scan systems explicitly included in the assessment scope.
Mission 9 — Fingerprint Technologies
Section titled “Mission 9 — Fingerprint Technologies”Identify:
- Web Server
- CDN
- Reverse Proxy
- TLS Version
- HTTP Response
Useful tools:
whatweb example.comor
curl -I https://example.comMission 10 — Discover Public APIs
Section titled “Mission 10 — Discover Public APIs”Review:
/api
/swagger
/docs
/openapi
/graphqlExample:
curl https://example.com/swaggerMission 11 — Search Public Code Repositories
Section titled “Mission 11 — Search Public Code Repositories”Search GitHub for:
- API Keys
- Cloud URLs
- Terraform Files
- Dockerfiles
Example searches:
AWS_ACCESS_KEY_ID
terraform
Dockerfile
cloudformationMission 12 — Search for Exposed Storage
Section titled “Mission 12 — Search for Exposed Storage”Search for references to:
- Amazon S3
- Azure Blob Storage
- Google Cloud Storage
Example:
company-backup
company-public
assets.example.comDocument findings only.
Do not attempt unauthorised access.
Mission 13 — Document Cloud Technologies
Section titled “Mission 13 — Document Cloud Technologies”Identify:
- CDN
- Load Balancer
- Cloud Provider
- Web Framework
- API Gateway
- Storage Services
Create a technology inventory.
Mission 14 — Build an Attack Surface Diagram
Section titled “Mission 14 — Build an Attack Surface Diagram”Create a simple diagram.
Internet
↓
DNS
↓
CloudFront
↓
Load Balancer
↓
Application
↓
API
↓
Cloud StorageDocument every discovered public asset.
Mission 15 — Prepare Reconnaissance Report
Section titled “Mission 15 — Prepare Reconnaissance Report”Summarize:
- Domains
- Subdomains
- DNS Records
- Public Services
- Cloud Provider
- Technologies
- APIs
- Potential Attack Surface
Do not include exploitation.
Reconnaissance only.
Deliverables
Section titled “Deliverables”Create:
- Reconnaissance Report
- Asset Inventory
- DNS Inventory
- Public Service List
- Technology Stack
- Attack Surface Diagram
- Screenshots
- Notes
Validation Checklist
Section titled “Validation Checklist”Verify:
- DNS records identified
- WHOIS completed
- Subdomains discovered
- Certificate transparency reviewed
- Cloud provider identified
- HTTP headers reviewed
- Public services documented
- Technologies identified
- APIs discovered
- Attack surface diagram created
- Reconnaissance report completed
Troubleshooting
Section titled “Troubleshooting”DNS Lookup Fails
Section titled “DNS Lookup Fails”Verify:
dig google.comCheck internet connectivity.
Nmap Returns No Results
Section titled “Nmap Returns No Results”Confirm:
- Target is online.
- Target is within assessment scope.
- Local firewall is not blocking traffic.
Amass Not Installed
Section titled “Amass Not Installed”Install:
sudo snap install amassor
go install github.com/owasp-amass/amass/v4/...@masterWHOIS Missing
Section titled “WHOIS Missing”Install:
sudo apt install whois -yLab Challenge
Section titled “Lab Challenge”Without using the step-by-step guide:
- Identify all public subdomains.
- Determine the cloud provider.
- Identify the CDN.
- Locate public APIs.
- Produce an attack surface diagram.
- Write a professional reconnaissance report.
Knowledge Check
Section titled “Knowledge Check”1. Why is reconnaissance the first stage of a penetration test?
Section titled “1. Why is reconnaissance the first stage of a penetration test?”Answer: Reconnaissance gathers information about the target environment, helping testers understand the attack surface before conducting deeper assessments.
2. What is the difference between passive and active reconnaissance?
Section titled “2. What is the difference between passive and active reconnaissance?”Answer: Passive reconnaissance collects publicly available information without directly interacting with target systems, while active reconnaissance sends requests to authorised targets to gather additional technical details.
3. Why are certificate transparency logs useful?
Section titled “3. Why are certificate transparency logs useful?”Answer: They reveal publicly issued TLS certificates, which often expose subdomains and internet-facing services that may not be obvious through standard DNS lookups.
4. Why should reconnaissance findings be documented?
Section titled “4. Why should reconnaissance findings be documented?”Answer: A complete inventory of discovered assets provides the foundation for later enumeration, vulnerability assessment and attack path analysis.
5. Why should penetration testers avoid exploiting systems during reconnaissance?
Section titled “5. Why should penetration testers avoid exploiting systems during reconnaissance?”Answer: The objective of reconnaissance is information gathering. Exploitation at this stage may violate the agreed Rules of Engagement and unnecessarily increase risk.
Key Takeaways
Section titled “Key Takeaways”- Reconnaissance establishes the foundation for every cloud penetration test.
- Passive techniques help identify cloud assets without directly interacting with target systems.
- Active reconnaissance validates publicly exposed services within the authorised assessment scope.
- A complete asset inventory and attack surface map improve the effectiveness of later assessment phases.
- Professional penetration testers carefully document reconnaissance findings before moving to enumeration.
What’s Next?
Section titled “What’s Next?”In the next lab, you will perform Lab 03 — Cloud Enumeration, where you will authenticate to cloud services, enumerate IAM identities, storage, compute resources, networking and Kubernetes components to build a detailed understanding of the cloud environment.
➡️ Next Lab: Lab 03 — Cloud Enumeration