Cloud / SaaS extras
Public buckets and metadata still pay. Most of the work is proving it is theirs.
Tags: cloud, ssrf, secrets
Checklist
- Ownership — DNS, TLS SAN, response body, billing alias. Do not report a bucket you cannot attribute.
- Storage — S3/GCS/Azure list, write, ACL. Directory listing vs authenticated read vs public write.
- Firebase / Supabase — Open rules, open signup, stored XSS in the project, IDOR in collections.
- Metadata — Only via an SSRF you already proved. IMDSv2 needs headers; that is a bypass step, not a stop.
- Takeovers — CNAME to a deprovisioned SaaS. Confirm the fingerprint, then a harmless claim.
- Keys — JS, mobile, CI, GitHub. Verify live and map the privilege before reporting a string that looks like a key.