Lab 01 — Enterprise Cloud Reconnaissance & Initial Access Assessment

Mission Information

Property	Value
Lab Name	Enterprise Cloud Reconnaissance & Initial Access Assessment
Module	Module 08 — Cloud Red Team Operations
Lab Number	Lab 01
Difficulty	Intermediate
Estimated Time	3–4 Hours
Cloud Platforms	AWS, Microsoft Azure, Google Cloud
Tools Used	WHOIS, nslookup, dig, Nmap, Amass, Subfinder, httpx, AWS CLI, Azure CLI, Google Cloud CLI, curl
Prerequisites	Complete Lessons 01–10
Objective	Perform a complete enterprise reconnaissance exercise, identify cloud attack surface, enumerate exposed assets, validate an approved initial access scenario, and document findings following professional Red Team methodology.

Scenario

CloudNova Technologies has been contracted to perform an authorized Cloud Red Team engagement for MedSecure Global.

Before any identity attacks or privilege escalation activities begin, leadership wants to understand the organization’s external cloud exposure.

Your objective is to simulate the first phase of an advanced cloud attacker by collecting publicly available information, mapping cloud assets, identifying exposed cloud services, and validating a controlled initial access scenario using a dedicated Red Team account.

This engagement is fully authorized and performed only within approved lab environments.

Lab Objectives

By the end of this lab you should be able to:

Perform external cloud reconnaissance.
Identify cloud provider usage.
Enumerate DNS infrastructure.
Discover cloud-hosted assets.
Identify exposed storage and APIs.
Enumerate identity entry points.
Map public cloud services.
Build an external attack surface inventory.
Validate an approved initial access scenario.
Document findings in a professional consulting format.

Enterprise Architecture

Internet

        │

        ▼

Corporate Domains

        │

 ┌──────┴────────┐

 ▼               ▼

Public APIs   Identity Portals

 ▼               ▼

AWS      Azure      Google Cloud

 ▼         ▼             ▼

Storage   Functions   Kubernetes

 ▼         ▼             ▼

Synthetic Test Resources

Lab Requirements

Before beginning, ensure you have:

AWS test account
Azure test subscription
Google Cloud test project
Kali Linux or Ubuntu workstation
Internet connectivity
AWS CLI
Azure CLI
Google Cloud SDK
Nmap
Amass
Subfinder
httpx
dig
nslookup
curl

Lab Task 01 — Define the Rules of Engagement

Review the approved engagement documentation.

Document:

Scope
Authorized domains
Approved cloud accounts
Testing windows
Communication procedures
Emergency contacts
Stop conditions
Evidence collection process

Expected Output

Rules of Engagement Reviewed

Scope Confirmed

Testing Window Confirmed

Authorized Assets Verified

Stop Conditions Understood

Lab Task 02 — Identify Public Domains

Identify the approved domains for assessment.

Example:

medsecure-global.com

dev.medsecure-global.com

portal.medsecure-global.com

api.medsecure-global.com

Document:

Domain owner
Registrar
DNS provider
Public records
Cloud provider indicators

Expected Output

Domain Inventory Completed

Lab Task 03 — DNS Enumeration

Collect DNS records.

Example commands:

dig medsecure-global.com ANY

nslookup medsecure-global.com

dig api.medsecure-global.com

dig TXT medsecure-global.com

Document:

A Records
AAAA Records
MX Records
TXT Records
CNAME
NS Records

Expected Output

DNS Inventory Completed

Lab Task 04 — Identify Cloud Providers

Determine which cloud providers are being used.

Look for indicators such as:

amazonaws.com
azurewebsites.net
cloudapp.azure.com
googleapis.com
appspot.com
cloudfunctions.net
storage.googleapis.com

Document:

AWS services
Azure services
Google Cloud services

Expected Output

Cloud Provider Inventory Completed

Lab Task 05 — Enumerate Subdomains

Use approved reconnaissance tools.

Example:

subfinder -d medsecure-global.com

amass enum -d medsecure-global.com

Record:

API endpoints
Admin portals
Development systems
Authentication services
Storage endpoints

Expected Output

Subdomain Enumeration Complete

Lab Task 06 — Discover Public Web Services

Identify exposed HTTP services.

Example:

httpx -l domains.txt

Record:

HTTP Status
HTTPS Status
Technologies
Response headers
Redirects

Expected Output

Web Service Inventory Completed

Lab Task 07 — Enumerate Public Cloud Storage

Search for approved storage resources.

Examples include:

Amazon S3
Azure Blob Storage
Google Cloud Storage

Record:

Bucket names
Storage accounts
Public access
Authentication requirements

Expected Output

Storage Assessment Completed

Lab Task 08 — Identify Identity Entry Points

Locate authentication portals.

Examples:

AWS IAM Identity Center
Azure Entra ID
Google Identity
SAML Login
OAuth Portals

Document:

Authentication URL
Identity Provider
MFA
Federation

Expected Output

Identity Entry Points Identified

Lab Task 09 — Validate Initial Access

Using an approved Red Team account:

Authenticate to the cloud environment.

Validate:

Successful login
Session creation
Audit log generation
MFA operation
Assigned permissions

Do not attempt privilege escalation.

Validation Checklist

Lab Task 10 — Build the Attack Surface Map

Create a diagram similar to:

Internet

↓

Corporate Domain

↓

Identity Portal

↓

Public API

↓

Storage

↓

Cloud Services

↓

Serverless

↓

Containers

↓

Kubernetes

↓

Synthetic Business Assets

Expected Output

Professional Attack Surface Diagram

Lab Task 11 — Create the External Asset Inventory

Document every discovered asset.

Asset	Platform	Exposure	Authentication	Owner
Portal	Azure	Public	Entra ID	IAM Team
API	AWS	Public	IAM	API Team
Storage	AWS S3	Private	IAM	Platform Team
Function	Azure	Private	Managed Identity	DevOps
Cluster	GKE	Internal	Service Account	Kubernetes Team

Lab Task 12 — Initial Risk Assessment

Classify each finding.

Risk	Severity	Business Impact
Public API	Medium	Customer Exposure
Identity Portal	Low	Expected Exposure
Public Storage	High	Data Exposure
Public Admin Portal	Critical	Administrative Access

Deliverables

Produce the following consulting documents:

Rules of Engagement Review
Domain Inventory
DNS Assessment
Cloud Provider Inventory
Public Asset Inventory
Identity Entry Point Register
Initial Access Validation Report
External Attack Surface Diagram
Initial Risk Assessment
Executive Summary

Success Criteria

You have successfully completed this lab when you can:

Identify all approved public cloud assets.
Map cloud providers.
Enumerate identity services.
Validate controlled initial access.
Build an attack surface map.
Produce professional consulting documentation.
Identify initial business risks.
Present findings suitable for executive review.

Key Learning Outcomes

After completing this lab, you will be able to:

Perform enterprise cloud reconnaissance.
Map public cloud infrastructure.
Discover identity entry points.
Enumerate externally accessible cloud resources.
Validate authorized initial access.
Build professional attack surface documentation.
Think like a Cloud Red Team Operator during the reconnaissance phase.
Prepare the environment for deeper identity, privilege escalation, and lateral movement assessments in subsequent labs.

What’s Next?

➡️ Lab 02 — Cloud Identity & Privilege Escalation Assessment

In the next lab, you will move beyond external reconnaissance and begin assessing the identities that secure enterprise cloud environments. You will enumerate AWS IAM users and roles, Microsoft Entra ID identities, Google Cloud IAM principals, Kubernetes service accounts, managed identities, service principals, and workload identities to understand how permissions are assigned across a multi-cloud infrastructure.

You will identify excessive permissions, analyze trust relationships, discover privilege escalation opportunities, and validate an approved privilege escalation scenario using dedicated test identities and synthetic cloud resources. Throughout the assessment, you will build identity attack graphs, evaluate business impact, document security risks, and produce executive-ready consulting deliverables using the GoHackersCloud Enterprise Cloud Red Team Operations Framework.

By the end of the next lab, you will be able to identify cloud identity weaknesses, understand how attackers abuse trust relationships to escalate privileges, and provide practical remediation recommendations that strengthen enterprise cloud identity security.