vulns.co
/
GKData.io MCP

Back to Checklists

Cloud / SaaS extras

Public buckets and metadata still pay. Most of the work is proving it is theirs.

Tags: cloud, ssrf, secrets

Checklist

  • Ownership: DNS, TLS SAN, response body, billing alias. Do not report a bucket you cannot attribute.
  • Storage: S3/GCS/Azure list, write, ACL. Directory listing vs authenticated read vs public write.
  • Firebase / Supabase: Open rules, open signup, stored XSS in the project, IDOR in collections.
  • Metadata: Only via an SSRF you already proved. IMDSv2 needs headers; that is a bypass step, not a stop.
  • Takeovers: CNAME to a deprovisioned SaaS. Confirm the fingerprint, then a harmless claim.
  • Keys: JS, mobile, CI, GitHub. Verify live and map the privilege before reporting a string that looks like a key.