cloud_enum vs CloudFlair
GitHub Stats
About cloud_enum
cloud_enum is a multi-cloud OSINT tool that enumerates public resources in Amazon Web Services, Microsoft Azure, and Google Cloud Platform. Given a set of keywords, it discovers publicly accessible storage buckets (S3, Azure Blobs, GCP Buckets), web applications (Azure App Services, AWS Elastic Beanstalk), databases, and other resources that may be inadvertently exposed. It uses brute-force enumeration with configurable wordlists and mutation rules to generate permutations of target keywords, then checks each cloud provider for matching resources. This is particularly effective during the reconnaissance phase of penetration tests or bug bounty hunting, where misconfigured cloud storage is a common finding.
About CloudFlair
CloudFlair is a tool for finding origin servers of websites protected by Cloudflare, using Internet-wide scan data from Censys. When a website uses Cloudflare as a reverse proxy, the actual origin server's IP address is hidden. CloudFlair works by searching Censys for IPv4 hosts that present an SSL certificate associated with the target domain, then checks each candidate to see if it responds with the same content as the Cloudflare-protected site. This technique is effective because many administrators configure SSL certificates on their origin servers that match the domain they're protecting, but forget to restrict direct IP access. It's a valuable tool for penetration testers looking to bypass Cloudflare's WAF and DDoS protection.
Platform Support
Tags
cloud_enum only
CloudFlair only