3.2.3. Multipurpose and Cloud Assessment Tools
💡 First Principle: Cloud environments require cloud-native assessment tools because traditional network scanners can't evaluate cloud-specific misconfigurations — IAM policy over-permissiveness, S3 bucket exposure, or insecure serverless function permissions are invisible to a port scanner.
Multipurpose Tools:
Nmap — The foundational network scanner. Beyond port scanning, Nmap's NSE (Nmap Scripting Engine) enables vulnerability detection, service version enumeration, and custom checks. Syntax fundamentals:
-sS— SYN scan (stealth)-sV— Service/version detection-O— OS detection-A— Aggressive scan (OS + version + scripts + traceroute)-p 1-1024— Specific port range-sU— UDP scan (finds services like DNS/53, SNMP/161, and DHCP/67 that a TCP-only scan misses)-T0–-T5— Timing template (speed vs. stealth). Use a slow-T1/-T2on fragile OT/ICS or IDS-monitored networks to avoid disruption or detection;-T4is common for fast internal scans
⚠️ Exam Trap: Default TCP scans (-sS/-sV) never reveal UDP-only services — a missing -sU leaves DNS, SNMP, and DHCP exposures undetected. And on sensitive OT/SCADA networks, an aggressive scan (-A, high -T) can crash fragile devices; dial the timing down.
Metasploit Framework — The industry-standard penetration testing and exploit development platform. From a vulnerability assessment perspective: Metasploit validates whether a vulnerability is actually exploitable (not just theoretically present). An analyst can test whether a Nessus-flagged vuln can actually be exploited — confirming true positives and eliminating false positives.
Recon-ng — A web reconnaissance framework for OSINT gathering. Modules for gathering domain information, email addresses, social media profiles, and infrastructure data — useful for external attack surface assessment.
Angry IP Scanner — Lightweight, cross-platform network scanner for quick host discovery and port scanning. Less powerful than Nmap but simpler for basic asset discovery.
Maltego — Visual link analysis tool for mapping relationships between entities (domains, IPs, email addresses, organizations). Used in threat intelligence and external attack surface mapping.
Cloud Infrastructure Assessment Tools:
| Tool | Cloud Platform | Primary Function |
|---|---|---|
| Scout Suite | AWS, Azure, GCP, multi-cloud | Audits cloud configurations against security best practices; identifies exposed storage, overpermissive IAM, insecure network configurations |
| Prowler | AWS | Command-line tool running CIS AWS Benchmark checks; automated compliance scanning for AWS environments |
| Pacu | AWS | AWS exploitation framework for pentesting — tests whether identified misconfigurations are actually exploitable |
The cloud assessment workflow mirrors traditional vulnerability scanning: Scout Suite/Prowler find misconfigurations → validate severity → prioritize by exploitability and asset criticality → remediate.
⚠️ Exam Trap: Cloud misconfigurations are typically more severe than traditional unpatched software vulnerabilities — a publicly accessible S3 bucket containing customer data is immediately exploitable with no technical skill. Cloud assessments should be a routine part of any vulnerability management program, not an occasional one-off.
Reflection Question: A cloud security assessment using Scout Suite identifies 847 findings across an AWS environment. The most critical: three S3 buckets with public read access, an IAM user with administrator privileges and no MFA, and 15 EC2 security groups allowing unrestricted inbound SSH (0.0.0.0/0). Using the principle that attackers prioritize the easiest path to the most valuable target, in what order would you prioritize these three findings and why?
