Cloud Storage OSINT

38.1 Verified Tools

Tool	URL	Function
GrayhatWarfare	https://buckets.grayhatwarfare.com	712K+ indexed buckets (2K free, premium paid)
osint.sh/buckets	https://osint.sh/buckets	Keyword search across AWS+Azure buckets
cloud_enum	https://github.com/initstring/cloud_enum	Multi-cloud enumeration (AWS / Azure / GCP)
GrayhatWarfare Shorteners	https://grayhatwarfare.com	URL shortener enumeration

38.2 Cloud Storage OSINT Workflow — 8 Steps

1. Identify candidate bucket names based on target domain (e.g. acmecorp-backups, acme-assets, acme-public).
2. Search GrayhatWarfare by target keyword.
3. Validate with cloud_enum (permutation brute-force of plausible names).
4. If an open bucket is found, enumerate objects with aws s3 ls --no-sign-request s3://bucket-name/ --recursive.
5. Document timestamp + hash before downloading evidence.
6. For Azure: use Azure Storage Explorer or az storage blob list --account-name X --container-name Y --auth-mode login.
7. For GCP: gsutil ls gs://bucket-name/ (without auth shows public objects).
8. Responsible disclosure if sensitive data is found exposed.

38.3 Cloud Storage Google Dorks

site:s3.amazonaws.com "target"
site:blob.core.windows.net "target"
site:storage.googleapis.com "target"
site:amazonaws.com filetype:pdf "confidential"

38.4 Legal Considerations

• Accessing a public bucket is legitimate. If the bucket is open, it is the owner's responsibility.
• Downloading sensitive data (PII, credentials) and publishing it = illegal in most jurisdictions.
• Report to the owner via responsible disclosure (security.txt of the domain).
• Do not use found credentials to escalate access. That crosses from OSINT into attack.

---