CloudBrute is an open-source cloud infrastructure enumeration and reconnaissance tool written in Go, created by security researcher 0xsha. Unlike ScoutSuite, Prowler, or Pacu — all of which require valid cloud credentials to operate — CloudBrute is designed for the unauthenticated OSINT/reconnaissance phase of an assessment. It discovers an organization’s cloud footprint by brute-forcing and permuting likely resource names (buckets, applications, storage accounts, app services) across multiple cloud providers simultaneously, based on a target company or keyword name and a wordlist.
CloudBrute supports discovery across numerous cloud platforms and services, including:
- Amazon Web Services (S3 buckets, AWS-hosted apps)
- Google Cloud Platform (Cloud Storage buckets, GCP-hosted apps)
- Microsoft Azure (Blob Storage, Azure App Services)
- DigitalOcean Spaces
- Alibaba Cloud OSS
- Vultr Object Storage
- Linode Object Storage
- Generic app/storage discovery across custom domains
The tool works by combining a target’s keyword (usually the company name) with a wordlist of common permutations (-dev, -prod, -backup, -assets, -staging, etc.) to generate thousands of candidate resource names, then checks each candidate’s existence and accessibility via DNS resolution and HTTP requests, flagging which resources exist and whether they are publicly accessible.
CloudBrute is most valuable during the early reconnaissance phase of a penetration test or bug bounty engagement, before any credentials have been obtained, to map out “shadow IT” cloud assets that an organization may not even be aware exist.
Installation
Method 1: Download pre-compiled binary (fastest, recommended for Kali)
wget https://github.com/0xsha/CloudBrute/releases/latest/download/CloudBrute-linux-amd64.tar.gz
tar -xzf CloudBrute-linux-amd64.tar.gz
chmod +x cloudbrute
sudo mv cloudbrute /usr/local/bin/
Method 2: Install via Go
sudo apt install golang-go -y
go install github.com/0xsha/CloudBrute@latest
export PATH=$PATH:$(go env GOPATH)/bin
Method 3: Build from source
git clone https://github.com/0xsha/CloudBrute.git
cd CloudBrute
go build .
sudo mv cloudbrute /usr/local/bin/
Verify installation:
cloudbrute -h
Expected output:
CloudBrute v1.0.6 - Cloud Enumeration Tool
Usage:
cloudbrute [flags]
Syntax
cloudbrute -d <domain> -k <keyword> -w <wordlist> [options]
Minimal required flags: target domain, keyword, and wordlist.
Complete Command-Line Options Reference
-a, --account string Specific cloud account/tenant name to check (Azure-specific scenarios)
-C, --cloud string Restrict scan to a specific cloud provider (aws, gcp, azure, do, alibaba, etc.)
-d, --domain string Target domain name (used for DNS-based checks and app discovery)
-k, --keyword string Base keyword to permute (typically the company/target name)
-w, --wordlist string Path to the wordlist file used for permutations
-m, --mode string Mode of operation: "storage" (buckets) or "app" (hosted applications)
-t, --threads int Number of concurrent threads (default: 80)
-T, --timeout int HTTP request timeout in seconds (default: 10)
-o, --output string Path to save output results to a file
-p, --proxy string Route requests through a specified HTTP proxy
-H, --header string Add a custom HTTP header to requests
-U, --randomagent Randomize the User-Agent header for each request
-D, --debug Enable debug/verbose output
-v, --version Display CloudBrute version
-h, --help Display help menu
--confidence int Confidence threshold for filtering false positives
--http-only Only test HTTP (not HTTPS) endpoints
--https-only Only test HTTPS endpoints
--environment string Target a specific environment configuration file (config.yaml)
Basic Usage
cloudbrute -d example.com -k example -w /usr/share/wordlists/cloudbrute/storage_small.txt -m storage
Expected console output:
$ cloudbrute -d example.com -k example -w storage_small.txt -m storage
_____ _ _ ____ _
/ ____| | | | _ \ | |
| | | | ___ _ _ __| | |_) |_ __ _ _| |_ ___
| | | |/ _ \| | | |/ _` | _ <| '__| | | | __/ _ \
| |____| | (_) | |_| | (_| | |_) | | | |_| | || __/
\_____|_|\___/ \__,_|\__,_|____/|_| \__,_|\__\___|
CloudBrute v1.0.6 - Starting scan...
Target Keyword: example
Wordlist loaded: 2,431 permutations
Mode: storage
Threads: 80
[FOUND] AWS S3 -> example-backup.s3.amazonaws.com [200 OK - Listable]
[FOUND] AWS S3 -> example-dev.s3.amazonaws.com [403 Forbidden - Exists]
[FOUND] GCP GCS -> example-assets.storage.googleapis.com [200 OK - Listable]
[FOUND] Azure -> exampleprod.blob.core.windows.net [404 Not Found]
Scan complete: 4 assets found out of 2,431 checked in 47 seconds
Results saved to: cloudbrute-results.txt
Practical Examples with Output
Example 1: Basic storage bucket enumeration across all supported clouds
cloudbrute -d acme.com -k acme -w /usr/share/wordlists/cloudbrute/storage_small.txt -m storage
[FOUND] AWS S3 -> acme-uploads.s3.amazonaws.com [200 OK - Listable]
[FOUND] AWS S3 -> acme-logs.s3.amazonaws.com [403 Forbidden - Exists]
Scan complete: 2 assets found out of 3,102 checked in 52 seconds
Example 2: Restrict scan to AWS only
cloudbrute -d acme.com -k acme -w storage_small.txt -m storage -C aws
Restricting scan to cloud provider: aws
[FOUND] AWS S3 -> acme-backup.s3.amazonaws.com [200 OK - Listable]
[FOUND] AWS S3 -> acme-static-assets.s3.amazonaws.com [403 Forbidden]
Scan complete: 2 AWS assets found in 18 seconds
Example 3: Enumerate hosted applications instead of storage buckets
cloudbrute -d acme.com -k acme -w app_wordlist.txt -m app
Mode: app (application discovery)
[FOUND] AWS -> acme-staging.elasticbeanstalk.com [200 OK]
[FOUND] Azure -> acme-api.azurewebsites.net [200 OK]
Scan complete: 2 hosted applications found in 63 seconds
Example 4: Increase thread count for a faster scan against a large wordlist
cloudbrute -d acme.com -k acme -w big_wordlist.txt -m storage -t 200
Threads: 200 (increased from default 80)
Wordlist loaded: 15,320 permutations
Scan complete: 7 assets found in 94 seconds
Example 5: Save results to an output file for later processing
cloudbrute -d acme.com -k acme -w storage_small.txt -m storage -o /home/kali/results/acme-cloudbrute.txt
Results will be saved to: /home/kali/results/acme-cloudbrute.txt
Scan complete: 5 assets found, results written to file
Example 6: Route scan traffic through Burp Suite for inspection
cloudbrute -d acme.com -k acme -w storage_small.txt -m storage -p http://127.0.0.1:8080
Proxy configured: http://127.0.0.1:8080
All HTTP/HTTPS requests routed through proxy
Scan complete: 3 assets found in 71 seconds (slower due to proxy overhead)
Example 7: Randomize User-Agent to reduce fingerprinting/blocking
cloudbrute -d acme.com -k acme -w storage_small.txt -m storage -U
User-Agent randomization enabled
Scan complete: 4 assets found in 55 seconds
Example 8: Target a specific Azure account/tenant name directly
cloudbrute -d acme.com -k acme -w storage_small.txt -m storage -C azure -a acmeprod
Restricting scan to cloud provider: azure
Testing account variations against base: acmeprod
[FOUND] Azure -> acmeprod.blob.core.windows.net [200 OK - Listable]
Scan complete: 1 asset found in 12 seconds
Example 9: Debug mode to see every request being made
cloudbrute -d acme.com -k acme -w storage_small.txt -m storage -D
[DEBUG] Checking: acme-01.s3.amazonaws.com -> DNS resolution failed
[DEBUG] Checking: acme-02.s3.amazonaws.com -> DNS resolution failed
[DEBUG] Checking: acme-backup.s3.amazonaws.com -> 200 OK
...
Scan complete: 4 assets found in 61 seconds
Example 10: Set a custom timeout for slow networks
cloudbrute -d acme.com -k acme -w storage_small.txt -m storage -T 20
HTTP timeout set to 20 seconds
Scan complete: 4 assets found in 88 seconds (fewer timeouts)
Example 11: Add a custom HTTP header (e.g., for authenticated proxy environments)
cloudbrute -d acme.com -k acme -w storage_small.txt -m storage -H "X-Engagement-ID: PT-2026-047"
Custom header added to all requests: X-Engagement-ID: PT-2026-047
Scan complete: 4 assets found in 58 seconds
Example 12: Combine keyword variations by running multiple scans with different keywords
for kw in acme acmecorp acme-inc; do
cloudbrute -d acme.com -k "$kw" -w storage_small.txt -m storage -o "results-$kw.txt"
done
[+] Scanning keyword: acme -> 4 assets found
[+] Scanning keyword: acmecorp -> 2 assets found
[+] Scanning keyword: acme-inc -> 1 asset found
Common Use Cases
- Bug bounty reconnaissance: Mapping a target’s cloud attack surface before diving into web application testing.
- External penetration test scoping: Discovering “shadow IT” cloud assets not listed in the client’s provided asset inventory.
- Red team OSINT phase: Identifying exposed development/staging buckets that may leak credentials, source code, or internal documentation.
- Continuous attack surface monitoring: Running scheduled scans against a company’s known keywords to detect newly created (and potentially misconfigured) cloud assets.
- Merger & acquisition due diligence: Quickly assessing the cloud security exposure of a company being acquired.
Automation with Bash
Automated scheduled attack-surface monitoring script:
#!/bin/bash
# cloudbrute-monitor.sh
# Runs CloudBrute weekly and diffs results against the previous run to detect new exposures
TARGET_DOMAIN="acme.com"
KEYWORD="acme"
WORDLIST="/usr/share/wordlists/cloudbrute/storage_small.txt"
RESULTS_DIR="/home/kali/cloudbrute-monitor"
DATE=$(date +%F)
mkdir -p "$RESULTS_DIR"
cloudbrute -d "$TARGET_DOMAIN" -k "$KEYWORD" -w "$WORDLIST" -m storage \
-o "$RESULTS_DIR/results-$DATE.txt"
LATEST_PREV=$(ls -1 "$RESULTS_DIR" | grep results- | sort | tail -2 | head -1)
if [ -n "$LATEST_PREV" ]; then
echo "[+] Diffing against previous scan: $LATEST_PREV"
diff "$RESULTS_DIR/$LATEST_PREV" "$RESULTS_DIR/results-$DATE.txt" > "$RESULTS_DIR/diff-$DATE.txt"
if [ -s "$RESULTS_DIR/diff-$DATE.txt" ]; then
echo "[!] New or changed assets detected! See diff-$DATE.txt"
else
echo "[+] No changes detected since last scan."
fi
fi
Cron entry for weekly monitoring:
0 6 * * 1 /home/kali/scripts/cloudbrute-monitor.sh >> /var/log/cloudbrute-monitor.log 2>&1
Tips and Best Practices
- Always confirm the target scope (domain, company name) is within the authorized rules of engagement before scanning — CloudBrute performs unauthenticated but active DNS/HTTP probing that could be logged by the target.
- Use multiple keyword variations (company name, abbreviations, product names, subsidiary names) since organizations rarely use a single consistent naming convention across cloud resources.
- Start with the smaller default wordlists for speed, then run a larger, more exhaustive wordlist against confirmed cloud providers only (using
-C) to save time. - Combine CloudBrute results with S3Scanner for deeper inspection of any discovered AWS S3 buckets.
- Use
-U(random User-Agent) and reasonable-tthread counts to reduce the chance of triggering WAF/rate-limiting defenses on the target’s side. - Save raw output (
-o) for every scan to build a historical record for diffing and trend analysis over time.
Troubleshooting
| Issue | Cause | Resolution |
|---|---|---|
| No results found | Wordlist too small or keyword doesn’t match naming convention | Try larger wordlists and additional keyword variations |
| Scan is very slow | Too few threads or high-latency network/proxy | Increase -t thread count, remove proxy if not needed |
| Many false positives | Confidence threshold too low | Increase --confidence value if supported by version in use |
| DNS resolution failures for all candidates | No internet/DNS connectivity, or DNS resolver blocking | Verify connectivity with dig or nslookup, try a different DNS resolver |
| Proxy-routed scan fails | Proxy not running or wrong port | Verify proxy tool (e.g., Burp Suite) is listening on the specified port |
| Binary not found after install | /usr/local/bin not in $PATH | Add export PATH=$PATH:/usr/local/bin to ~/.bashrc |
References
- Official GitHub Repository: https://github.com/0xsha/CloudBrute
- Author’s Blog / Research: https://0xsha.io/
- OWASP Cloud Security Testing Guide: https://owasp.org/www-project-cloud-security/
- Kali Linux Tool Listing: https://www.kali.org/tools/cloudbrute/