EC-Council Certified Ethical Hacker (CEH) v12Reconnaissance TechniquesMedium
During a penetration test, an ethical hacker discovers that the target organization is heavily reliant on cloud services. The hacker wants to identify potential misconfigurations or exposed storage buckets within the client's cloud infrastructure (e.g., AWS S3 buckets, Azure Blob storage). Which reconnaissance tool or technique would be most effective for this specific task?
- AUsing Shodan to search for publicly exposed cloud storage instances associated with the organization.
- BExecuting a full TCP connect scan against the organization's on-premise IP ranges.
- CLeveraging Maltego to map out employee social media connections.
- DPerforming a WHOIS lookup on the organization's primary domain.
Show answer & explanationAnswer & explanation
Correct answer: A. Using Shodan to search for publicly exposed cloud storage instances associated with the organization.
Shodan is a search engine for internet-connected devices and services, including cloud storage instances. It can effectively identify publicly accessible or misconfigured storage buckets associated with an organization, making it ideal for this scenario.
Why the other options are wrong
- B. TCP connect scans target on-premise IP ranges and ports, not specifically cloud storage misconfigurations.
- C. Maltego is an OSINT tool for mapping relationships, primarily useful for people and domain mapping, not directly for finding cloud storage misconfigurations.
- D. WHOIS lookups provide domain registration details, not information about cloud storage misconfigurations.
Shodan
Shodan is a search engine that lets users find specific types of devices connected to the internet, including servers, routers, webcams, and industrial control systems, by filtering based on various criteria like ports, services, and banners.
- Often called the 'search engine for hackers'.
- Can discover publicly exposed services, open ports, and vulnerable devices.
- Useful for identifying IoT devices, database instances, and cloud storage buckets.
Memory trick: Shodan sees all, even the hidden cloud, if it's on the Net.