cloudscan

cloudscan discovers cloud storage assets from a target domain and validates public listing exposure.

Usage

cloudscan -domain example.com
cloudscan scan -domain example.com -depth 5 -max-pages 160

Pipeline

1. Headless spider (default depth 5) captures DOM links + network requests (including XHR/fetch) and extracts cloud asset references.
2. Curated cloud_enum-style name generation (internal/cloudenum/data/fuzz.txt, ~80 high-signal suffixes—not hundreds of random words) probes AWS S3, Azure Blob, and DigitalOcean Spaces patterns.
3. Each discovered asset is checked for public list access and up to 20 files/directories are captured.
4. scan.json, summary.json, and cloudscan-report.pdf are generated.

Output

For each run in out/<domain>/:

• scan.json full step-by-step findings (cloud_assets contains final validated assets)
• summary.json concise counters
• cloudscan-report.pdf JetBrains Mono report with public/restricted breakdown