Knock knock, who's there Identifying assets in the cloud
summary
Scans target cloud IP space at scale: a custom Go scanner plus go fingerprint and meg hit 535k /24s across 11 ports yielding 1.4 billion unique targets and ~28 million identified endpoints at ~1.6M checks/sec for ~$25 on AWS. Fingerprints detect swagger, GraphQL, Grafana (302→login or 3000), Spring Boot actuator httptrace/heapdump; vhost discrepancies reveal IP-accessible internals; exploits include Grafana SSRF, admin/admin logins and leaked cookies that pivot to internal apps. Recon API available at api.recon.dev.
AI-written summary · about
chapters (14)
- 0:00Start
- 0:09Introduction
- 9:06Checking for V Host Discrepancies
- 10:19Extracting Bug Bank Targets
- 17:15Swagger Resources
- 18:03Graphql
- 22:37Eliminate False Positives
- 25:14Real Life Examples
- 25:28Asset Monitoring
- 26:56Hunting for Cves
- 30:29Takeaways
- 38:51Lesson Learned
- 41:42V Host Scan
- 44:22Conclusion
related talks
26mInternet Scanning - Current State and Lessons Learned
11mReducing exposure in the cloud
40mBlind Spots: Two Cloud Threats You Didn’t Even Know You Had
38mHackers Gonna Hack: Identifying and Fixing Vulnerabilities Proactively
41mInternet Spelunking: IPv6 Scanning and Device Fingerprinting
50mThe Anatomy of Cloud Attacks
33mCloud Hacking Scenarios
33mDetecting SSRF events on AWS using Splunk