Authorized Cloud Pentest --- AWS S3 and Azure Blob Storage

The cloud is not a peripheral surface: thousands of leaks come from misconfigured buckets. KittySploit provides a coherent auxiliary chain for AWS and Azure, without relying on external tools for initial discovery.

KittySploit cloud module map

AWS family (auxiliary/aws)

Azure family (auxiliary/azure)

Workspace and scope preparation

workspace create cloud-audit-client-2026
workspace use cloud-audit-client-2026

# Scope: authorized domains and resource names
scope add client-corp.com
scope add assets.client-corp.com

sync now

For a purely cloud audit (no web target), the scope manager may remain disabled if you only call auxiliary modules with explicit targets. However, as soon as you combine agent --all or HTTP scanners, enable scope:

scope enable
scope list
scope status

Discovery via search

search s3 --type auxiliary
search aws --type auxiliary --tag cloud
search blob --type auxiliary
search azure --type auxiliary
search exposure --type auxiliary --tag misconfig
search cloud --type auxiliary --limit 50

Targeted searches by path:

search s3_bucket_access_check
search s3_exposure_audit
search blob_exposure_audit
search sensitive_pattern_scan --type auxiliary
search exposure_path_prioritizer

After git pull or marketplace installation:

sync now
search aws --type auxiliary
inventory --family auxiliary/aws
inventory --family auxiliary/azure

AWS pipeline --- S3 exposure audit

Step 1: spot check

use auxiliary/aws/s3_bucket_access_check
set target client-backups
set timeout 10
set output_file output/aws/access_check_client-backups.json
run

The module accepts a bucket name or URL:

set target https://client-backups.s3.amazonaws.com/
run

set target my-bucket
run

Observed signals:

• anonymous_list_public --- ListBucket listing without authentication ;
• website_endpoint_enabled --- active S3 static hosting ;
• risk_level --- LOW / MEDIUM / HIGH.

Step 2: multi-bucket audit

use auxiliary/aws/s3_exposure_audit
set target client-media
set buckets assets,media,public,backup,files,uploads,logs,data,staging
set timeout 8
set output_file output/aws/exposure_audit.json
run

Without an explicit target, the module tests the buckets list:

use auxiliary/aws/s3_exposure_audit
set buckets dev-logs,prod-logs,ci-artifacts,terraform-state
run

Step 3: object enumeration

use auxiliary/aws/s3_bucket_file_list
set target client-backups
set prefix backups/2026/
set max_results 500
set display_mode batch
set display_batch_size 100
set output_file output/aws/file_list.json
run

Display modes:

• stream --- continuous flow ;
• batch --- batches of display_batch_size ;
• end --- final summary only.

Step 4: sensitive pattern scan

use auxiliary/aws/s3_sensitive_pattern_scan
set target client-backups
set prefix config/
set max_files 300
set max_bytes_per_file 250000
set max_scan_seconds 120
set progress_every 25
set output_file output/aws/sensitive_scan.json
run

Step 5: controlled proof (download)

use auxiliary/aws/s3_file_download
set target client-backups
set key backups/2026/README.txt
set output_path output/aws/proof/README.txt
set overwrite false
set output_file output/aws/download_meta.json
run

Download only the minimum necessary for proof. Reference the file hash in the report.

Step 6: prioritization

Pipeline mode (JSON files from previous steps):

use auxiliary/aws/aws_s3_exposure_path_prioritizer
set exposure_file output/aws/exposure_audit.json
set list_file output/aws/file_list.json
set sensitive_file output/aws/sensitive_scan.json
set top_k 10
set output_file output/aws/prioritized_paths.json
run

Auto mode (internal collection):

use auxiliary/aws/aws_s3_exposure_path_prioritizer
set target client-backups
set auto_collect true
set max_list_files 3000
set max_quick_scan_files 120
set max_bytes_per_file 120000
set top_k 15
run

Azure pipeline --- Blob Storage audit

Step 1: exposure audit

use auxiliary/azure/blob_exposure_audit
set target clientstorage
set container media
set containers media,assets,public,backup,files,uploads,logs,data
set timeout 8
set output_file output/azure/exposure_audit.json
run

With SAS token (if provided in the mandate):

set target clientstorage
set sas_token sv=2022-11-02&ss=b&srt=sco&sp=rl&se=2026-12-31...
run

Exposure classifications: public_listing, public_access, restricted_or_private, not_found.

Step 2: blob list

use auxiliary/azure/blob_container_file_list
set target clientstorage
set container media
set prefix uploads/2026/
set max_results 1000
set output_file output/azure/file_list.json
run

Step 3: sampling

use auxiliary/azure/blob_file_sampler
set target clientstorage
set container media
set prefix public/
set max_files 50
set max_bytes_per_file 50000
set output_file output/azure/sampler.json
run

Step 4: sensitive scan

use auxiliary/azure/blob_sensitive_pattern_scan
set target clientstorage
set container media
set prefix config/
set max_files 200
set max_bytes_per_file 250000
set output_file output/azure/sensitive_scan.json
run

Step 5: download

use auxiliary/azure/blob_file_download
set target clientstorage
set container media
set files public/index.html,config/app-settings.json
set output_dir output/azure/downloads
set max_files 10
set max_bytes_per_file 5000000
set output_file output/azure/download_report.json
run

Auto-list mode (without explicit file list):

set files
set auto_collect true
set prefix logs/
set max_files 20
run

Step 6: write test (caution)

use auxiliary/azure/blob_write_access_check
set target clientstorage
set container staging
set dry_run true
set cleanup true
set output_file output/azure/write_check.json
run

By default dry_run=true: the module infers without real upload. An effective write test requires an explicit mandate and a dedicated test container.

Step 7: ACL hints and prioritization

use auxiliary/azure/blob_acl_misconfig_hint
set exposure_file output/azure/exposure_audit.json
set list_file output/azure/file_list.json
set sensitive_file output/azure/sensitive_scan.json
set output_file output/azure/acl_hints.json
run

use auxiliary/azure/azure_exposure_path_prioritizer
set target clientstorage
set container media
set auto_collect true
set exposure_file output/azure/exposure_audit.json
set list_file output/azure/file_list.json
set sensitive_file output/azure/sensitive_scan.json
set sampler_file output/azure/sampler.json
set top_k 10
set output_file output/azure/prioritized.json
run

Complete AWS scenario (session script)

workspace use fintech-cloud-2026
sync now

search s3 --type auxiliary

use auxiliary/aws/s3_exposure_audit
set buckets fintech-demo-assets,fintech-demo-backups,fintech-demo-logs
set output_file output/fintech/exposure.json
run

# If HIGH on fintech-demo-backups:
use auxiliary/aws/s3_bucket_file_list
set target fintech-demo-backups
set max_results 200
set output_file output/fintech/backup_list.json
run

use auxiliary/aws/s3_sensitive_pattern_scan
set target fintech-demo-backups
set max_files 100
set output_file output/fintech/sensitive.json
run

use auxiliary/aws/aws_s3_exposure_path_prioritizer
set exposure_file output/fintech/exposure.json
set list_file output/fintech/backup_list.json
set sensitive_file output/fintech/sensitive.json
set top_k 5
run

host note cloud-s3 "fintech-demo audit complete - see output/fintech/"
vuln list

Complete Azure scenario

workspace use healthcorp-azure-2026

search blob_exposure --type auxiliary

use auxiliary/azure/blob_exposure_audit
set target healthcorpstore
set containers patient-exports,imaging,public-www
set output_file output/healthcorp/exposure.json
run

use auxiliary/azure/blob_container_file_list
set target healthcorpstore
set container patient-exports
set max_results 100
set output_file output/healthcorp/patient_list.json
run

use auxiliary/azure/blob_sensitive_pattern_scan
set target healthcorpstore
set container patient-exports
set max_files 50
set max_bytes_per_file 100000
set output_file output/healthcorp/sensitive.json
run

use auxiliary/azure/azure_exposure_path_prioritizer
set exposure_file output/healthcorp/exposure.json
set list_file output/healthcorp/patient_list.json
set sensitive_file output/healthcorp/sensitive.json
set top_k 8
run

Integration with the autonomous agent

Cloud modules are included in the agent's extended surface:

agent client-corp.com \
  --all \
  --no-exploit \
  --safety-profile discreet \
  --goal recon \
  --request-budget 30

The agent can chain OSINT, auxiliary/aws, auxiliary/azure, and a bounded HTTP scan on discovered subdomains. For a targeted cloud audit:

agent https://assets.client-corp.com \
  --profile safe-web \
  --no-exploit \
  --approve-risk read \
  --request-budget 25

Combine with a policy:

safety_profile = "discreet"
approved_risks = ["read"]
request_budget = 20
deny = ["payment.client-corp.com"]

agent client-corp.com \
  --all \
  --policy missions/cloud-readonly.toml \
  --validation

Professional interpretation of findings

For each cloud result, structure the report in four blocks:

1. Technical observation --- tested URL, HTTP code, redacted XML/JSON excerpt.
2. Configuration at fault --- bucket ACL, IAM policy, ``Blob anonymous access'', missing Block Public Access, overly permissive SAS.
3. Business impact --- backup leak, credentials, customer data, supply chain.
4. Remediation --- enable Block Public Access, restrict ACL, SAS rotation, SSE-KMS encryption, CloudTrail / Azure Monitor logging.

Indicative severity grid

Operational best practices

• Output naming --- prefix output/<client>/<date>/ to find JSON in campaign.
• JSON chaining --- *_prioritizer and *_misconfig_hint modules consume upstream step files; preserve paths in the workspace.
• Rate limiting --- increase timeout, reduce max_files ; avoid massive parallel scans on the same account.
• Minimal proof --- a SHA-256 hash and the first 10 redacted lines often suffice; avoid archiving full dumps.
• Traceability --- host note, vuln add, campaign exports --formats report,json.

Troubleshooting

# Module not found
sync now
search s3_bucket_access_check

# Frequent timeout
set timeout 20
run

# Bucket not found or typo
set target my-bucket-prod   # verify exact spelling
run

# Azure 403 with SAS
set sas_token <token without ?> 
run

# Invalid JSON input for the prioritizer
# Regenerate the upstream step or verify the output_file path

Common errors:

• invalid target --- incorrect bucket/account format ;
• no containers --- empty containers list on Azure ;
• request_failed --- firewall, cloud WAF, or rate limit ;
• Scope blocked --- target outside scope add during an agent run.

AWS vs Azure comparison (same KittySploit workflow)

Reporting Integration

campaign --preview
campaign --formats report,navigator,json
campaign run --formats report

Import output/ JSON as attachments or convert findings into vuln entries for ATT&CK consolidation.

Reference tasks