Cloud Attack Surface Mapping with masscan and TLS Fingerprinting

Context

Cloud IP space has no reverse DNS to map an address back to an owner, so this lab uses the TLS certificate as the attribution mechanism. The workflow is: sweep a /16 with masscan for one port, pull each host's certificate with tls-scan, parse the subject common name with jq to find which anonymous cloud IP belongs to the target organization, then enumerate that host with nmap.

Tools used

Steps taken

1Mass-sweep the /16 for port 443

Ran masscan across the entire 10.200.0.0/16 (65,536 hosts) for a single port at 10,000 packets/sec. The list output (-oL) recorded 14 open 443/tcp hosts. Scanning one port across a huge range is the fast way to find the live TLS surface before spending time on any single host.

$ masscan -p 443 --rate 10000 -oL simcloud.txt 10.200.0.0/16
$ wc -l simcloud.txt

-p 443single port

--rate 10000packets per second

-oLlist output format

2Extract the live IPs

masscan -oL lines look like 'open tcp 443 10.200.x.x <epoch>'. awk pulled field 4 (the IP) into a clean target list for the certificate scan.

$ awk '/open/ {print $4}' simcloud.txt > simcloud-targets.txt

/open/match result lines

{print $4}the IP address column

3Collect TLS certificates

tls-scan read the target list on stdin and completed all 14 handshakes in 0.13 seconds, writing structured JSON. This is the step that turns a list of anonymous IPs into a set of certificates that name their services.

$ tls-scan --port=443 --cacert=/opt/tls-scan/ca-bundle.crt -o simcloud-tlsinfo.json < simcloud-targets.txt

--port=443TLS port

--cacertCA bundle for chain validation

-oJSON output; reads targets on stdin

4Attribute IPs by certificate subject CN

jq projected each IP next to its certificate subject CN. Most were wildcards for unrelated tenants sharing the cloud range (*.genusight.com, *.sunsetisp.com). One stood out: 10.200.74.2 presenting downloads.falsimentis.com, the target organization.

$ jq '.ip + " " + .certificateChain[].subjectCN' simcloud-tlsinfo.json
$ jq '.ip + " " + .certificateChain[].subjectCN' simcloud-tlsinfo.json | grep falsimentis

certificateChain[].subjectCNthe CN names the service

grep isolates the target's asset

5Enumerate the identified host

With the target IP known, nmap -sV plus the http-enum NSE script fingerprinted nginx 1.18.0 and surfaced /robots.txt and a browsable /css/ directory listing. Attribution first, enumeration second, so the noisy scan only ever touches the one host that matters.

$ sudo nmap -sT -sV -p 443 --script http-enum 10.200.74.2

-sVversion detection

--script http-enumenumerate web paths

Key findings

Outcome / Lessons learned

Reduced a 65,536-address cloud range to the single host that belonged to the target by pivoting on TLS certificate subject CNs, then confirmed an exposed directory listing on it. 14 live TLS hosts, one match, one finding, in well under a minute of active scanning.

Run the same masscan-to-certificate sweep against your own cloud ranges on a schedule and diff the results so newly exposed hosts and unexpected certificate names get flagged as possible shadow assets. Remove directory listing (autoindex off) on the identified nginx host and review what /css/ and /robots.txt exposed. Feed discovered certificates into an inventory keyed on subject CN so attribution is automatic next time.

What I took away from this

Evidence gallery

123456