Cloud Reconnaissance

Learning Objectives

By the end of this lesson, you will be able to:

Understand the purpose of cloud reconnaissance.
Differentiate passive and active reconnaissance.
Identify common cloud attack surfaces.
Learn enterprise cloud asset discovery techniques.
Perform authorised reconnaissance safely.
Understand how reconnaissance supports penetration testing.

Introduction

Every successful penetration test begins with reconnaissance.

Before attempting to identify vulnerabilities, a Cloud Penetration Tester must first understand:

What cloud platform is being used?
What services are deployed?
What resources are publicly exposed?
How are identities managed?
Where are the potential attack paths?

Reconnaissance provides the intelligence needed to perform an effective security assessment.

What is Cloud Reconnaissance?

Cloud reconnaissance is the process of gathering information about a cloud environment before performing security testing.

The objective is to:

Discover assets
Map the environment
Identify technologies
Understand architecture
Locate exposed services
Reduce assumptions

Good reconnaissance leads to more focused and effective testing.

Cloud Reconnaissance Lifecycle

Planning

↓

Target Identification

↓

Passive Reconnaissance

↓

Active Reconnaissance

↓

Cloud Asset Discovery

↓

Technology Identification

↓

Attack Surface Mapping

↓

Assessment Planning

Why Reconnaissance Matters

Without reconnaissance, penetration testing becomes guesswork.

Reconnaissance helps you:

Reduce testing time.
Identify high-value assets.
Understand cloud architecture.
Discover exposed services.
Identify trust relationships.
Prioritise testing activities.

Passive vs Active Reconnaissance

Passive Reconnaissance	Active Reconnaissance
No direct interaction with target	Direct interaction with target
Lower risk	Higher visibility
Difficult to detect	Easier to detect
Public information gathering	Live service interrogation
Used first	Used after authorisation

Professional engagements typically begin with passive techniques.

Passive Reconnaissance

Passive reconnaissance collects publicly available information.

Examples include:

WHOIS records
DNS records
Public GitHub repositories
Certificate Transparency logs
Search engines
Public cloud storage
Company websites
Job advertisements
Social media

No direct communication with the target infrastructure is required.

Active Reconnaissance

Active reconnaissance interacts directly with authorised target systems.

Examples include:

DNS queries
Service discovery
Port identification
API enumeration
Cloud CLI queries
Kubernetes API discovery
Network validation

Only perform active reconnaissance within the approved Rules of Engagement.

Enterprise Cloud Attack Surface

Internet

↓

Domains

↓

DNS

↓

Cloud Load Balancers

↓

Cloud APIs

↓

Web Applications

↓

Storage Services

↓

Virtual Machines

↓

Containers

↓

Kubernetes

↓

Identity Services

Reconnaissance aims to understand this entire attack surface.

Target Identification

Before collecting information, identify:

Organisation name
Domains
Cloud providers
Business units
Public applications
APIs
Cloud accounts
Development environments

This helps define the scope of reconnaissance.

Domain Reconnaissance

Examples of information gathered include:

Registered domains
Subdomains
DNS records
Name servers
Mail servers
SPF records
DKIM records

Example:

dig example.com

nslookup example.com

Subdomain Discovery

Subdomains often expose:

Development environments
Test systems
APIs
Kubernetes dashboards
Internal applications

Common techniques:

Certificate Transparency Logs
DNS enumeration
Public search engines
Asset inventories

Cloud Provider Identification

Determine whether the organisation uses:

Amazon Web Services (AWS)
Microsoft Azure
Google Cloud Platform (GCP)
Multi-cloud deployments

Indicators include:

DNS records
Response headers
TLS certificates
Public IP ownership
CDN information

Understanding the cloud provider helps focus the assessment.

Cloud Asset Discovery

Examples of assets include:

Virtual Machines
Load Balancers
Storage Buckets
APIs
Databases
Kubernetes Clusters
Serverless Functions
Identity Providers

Each discovered asset may require additional assessment.

Storage Discovery

Review publicly accessible storage such as:

Amazon S3 Buckets
Azure Blob Storage
Google Cloud Storage

Common issues:

Public access
Sensitive files
Backup exposure
Excessive permissions

Always verify access only within the authorised scope.

API Discovery

Cloud APIs are common entry points.

Review:

REST APIs
GraphQL APIs
API Gateways
Swagger/OpenAPI documentation
Authentication methods
Rate limiting
Versioning

Poorly secured APIs can expose sensitive cloud functionality.

Kubernetes Discovery

Identify Kubernetes-related assets such as:

Public API servers
Ingress Controllers
Dashboard exposure
Cluster endpoints
Service endpoints
Namespace structure

Never attempt to access unauthorised clusters.

Identity Discovery

Review identity-related information including:

Login portals
Single Sign-On (SSO)
Identity Providers
Federation endpoints
Multi-Factor Authentication (MFA) configuration
Public authentication endpoints

Identity is often the primary attack surface in cloud environments.

Technology Fingerprinting

Determine which technologies are in use.

Examples include:

Web servers
Frameworks
Container platforms
Kubernetes
Cloud services
Reverse proxies
Content Delivery Networks (CDNs)

Technology identification helps determine likely attack paths.

Cloud Metadata

Where authorised, review metadata such as:

Resource tags
Service names
Environment names
Regions
Availability Zones
Deployment models

Metadata can reveal valuable information about the cloud environment.

Cloud CLI Reconnaissance

Once authorised, cloud command-line tools help enumerate resources.

Examples:

AWS

aws sts get-caller-identity
aws iam list-users
aws s3 ls

Azure

az account show
az group list

Google Cloud

gcloud projects list
gcloud compute instances list

Use only accounts and permissions that have been approved for the engagement.

Kubernetes Reconnaissance

Examples:

kubectl get nodes

kubectl get namespaces

kubectl get pods --all-namespaces

kubectl get services

These commands help build an understanding of the cluster layout.

Mapping the Attack Surface

After reconnaissance, create an attack surface map.

Internet

↓

DNS

↓

Web Application

↓

API Gateway

↓

IAM

↓

Storage

↓

Compute

↓

Containers

↓

Kubernetes

↓

Database

This map guides later testing activities.

Reconnaissance Deliverables

Professional engagements should produce:

Asset Inventory
Network Map
Cloud Architecture Diagram
Cloud Services Inventory
Identity Inventory
Public Exposure Report
Attack Surface Diagram
Initial Risk Summary

These deliverables provide a structured foundation for the assessment.

Enterprise Scenario

CloudNova Technologies requests a security assessment of its AWS environment.

During reconnaissance, you identify:

18 public subdomains
2 exposed APIs
1 publicly accessible S3 bucket
Amazon CloudFront distribution
Internet-facing Application Load Balancer
Amazon EKS cluster endpoint
Microsoft Entra ID login portal
Public GitHub repositories

This information helps determine where to focus subsequent testing activities.

Best Practices

Start with passive reconnaissance.
Respect the Rules of Engagement.
Document every discovered asset.
Validate information before drawing conclusions.
Maintain an organised asset inventory.
Minimise unnecessary interaction with target systems.
Update the attack surface map as new assets are discovered.

Common Mistakes

Avoid:

Beginning active testing without reconnaissance.
Testing systems outside the agreed scope.
Assuming all discovered assets belong to the target organisation.
Ignoring identity-related assets.
Failing to document findings.
Performing intrusive scans without authorisation.

Knowledge Check

1. What is the primary objective of cloud reconnaissance?

Answer: To gather information about the target cloud environment, identify assets, understand the architecture and build an accurate attack surface before conducting further security testing.

2. What is the difference between passive and active reconnaissance?

Answer: Passive reconnaissance collects publicly available information without interacting directly with the target, while active reconnaissance communicates with authorised target systems to gather additional technical details.

3. Why is cloud asset discovery important?

Answer: Cloud asset discovery helps identify resources that may contain vulnerabilities, expose sensitive data or expand the organisation’s attack surface.

4. Why should reconnaissance be documented?

Answer: Documentation creates an inventory of discovered assets, supports later testing phases and provides evidence for assessment reports.

5. Why do professional penetration testers perform reconnaissance before vulnerability testing?

Answer: Reconnaissance helps them understand the environment, prioritise testing efforts, reduce unnecessary risk and identify realistic attack paths.

Key Takeaways

Reconnaissance is the foundation of every cloud penetration test.
Passive reconnaissance should generally precede active reconnaissance.
Cloud attack surfaces include identities, APIs, storage, Kubernetes, compute services and networking.
Asset discovery improves testing efficiency and helps prioritise high-risk areas.
Professional reconnaissance is structured, documented and always conducted within authorised boundaries.

What’s Next?

In the next lesson, we will explore Cloud Enumeration, learning how authorised security testers enumerate cloud identities, resources, networking, storage, Kubernetes clusters and cloud-native services to build a detailed understanding of the target environment.

➡️ Next Lesson: Lesson 06 — Cloud Enumeration