CloudBrute
Awesome cloud enumerator
| Category | Penetration Testing Tools |
|---|---|
| Community Stars | 930 |
| Last Commit | 5 months ago |
| Last page update | 19 days ago |
| Pricing Details | Free and open-source |
| Target Audience | Security researchers, penetration testers, bug bounty hunters, and red team operators. |
CloudBrute tackles the challenge of identifying a company's infrastructure, files, and applications across various cloud providers, essential for security testing, bug bounty hunting, and red team operations.
Built as a Go application, it leverages a modular architecture to support various cloud providers such as Amazon, Google, Microsoft, DigitalOcean, Alibaba, and others. It uses wordlists to generate URLs and perform brute-force enumeration of storage buckets, applications, and databases. The tool supports concurrency with up to 80 threads by default, and it can be configured to use proxies for bypassing region restrictions and randomize user agents to evade detection.
Key operational considerations include the need for API keys or cloud provider configurations, which are managed through a config.yaml file. The tool allows for customization of wordlists, thread counts, and timeouts, making it flexible for different scanning scenarios.
Cloud provider specific searches can be run using the -c option, output customization to files or different formats, and debug logging for troubleshooting. The command-line interface is robust, allowing for fine-grained control over the scanning process, such as setting timeouts per request and using proxy lists to bypass restrictions.