Cloudlist is a multi-cloud tool developed by Project Discovery for listing assets from various cloud providers. It's designed to help security teams augment their Attack Surface Management efforts by discovering and monitoring cloud assets across multiple providers, including AWS, Azure, GCP, DigitalOcean, Linode, Alibaba Cloud, and more.
What sets Cloudlist apart from provider-specific tools is its unified interface for querying multiple cloud providers simultaneously. This significantly simplifies the process of maintaining an inventory of cloud assets, especially for organizations that use multiple cloud providers. Cloudlist provides consistent output regardless of the provider, making it easier to integrate into security workflows and automation pipelines.
Cloudlist is primarily intended for blue teams to maintain visibility into their cloud infrastructure, but it's also valuable for red teams and penetration testers who need to understand the attack surface of an organization. By providing a comprehensive view of cloud assets, Cloudlist helps security professionals identify potential security risks, such as exposed services, misconfigured resources, or unauthorized deployments.
# Install using Go (requires Go 1.20 or later)goinstall-vgithub.com/projectdiscovery/cloudlist/cmd/cloudlist@latest
# Verify installationcloudlist-version
# Install PDTM first if not already installedgoinstall-vgithub.com/projectdiscovery/pdtm/cmd/pdtm@latest
# Install Cloudlist using PDTMpdtm-icloudlist
# Verify installationcloudlist-version
# List assets from all configured providerscloudlist
# List assets from a specific providercloudlist-provideraws
# List assets from multiple providerscloudlist-provideraws,azure,gcp
# Add Cloudflare provider with API tokencloudlist-addcloudflare-cloudflare-tokenYOUR_CLOUDFLARE_API_TOKEN
# Add Cloudflare provider with API key and emailcloudlist-addcloudflare-cloudflare-keyYOUR_CLOUDFLARE_API_KEY-cloudflare-emailyour-email@example.com
# Filter by resource typecloudlist-resource-typeinstance
# Filter by multiple resource typescloudlist-resource-typeinstance,storage
# Filter by tagcloudlist-tagkey=value
# Filter by multiple tagscloudlist-tagkey1=value1,key2=value2
# List specific resource typescloudlist-resource-typeinstance# List only instancescloudlist-resource-typestorage# List only storage resourcescloudlist-resource-typenetwork# List only network resourcescloudlist-resource-typedatabase# List only database resourcescloudlist-resource-typecontainer# List only container resourcescloudlist-resource-typefunction# List only serverless functions
# Format output as IP:portcloudlist-format"\\\\{\\\\{.IP\\\\}\\\\}:\\\\{\\\\{.Port\\\\}\\\\}"# Format output as hostname and IPcloudlist-format"\\\\{\\\\{.Hostname\\\\}\\\\} (\\\\{\\\\{.IP\\\\}\\\\})"# Format output as JSON with specific fieldscloudlist-json-format"\\\\{\\\\{.ID\\\\}\\\\},\\\\{\\\\{.Name\\\\}\\\\},\\\\{\\\\{.IP\\\\}\\\\},\\\\{\\\\{.Provider\\\\}\\\\}"
# List cloud assets and probe for HTTP servicescloudlist-silent|httpx-silent
# List cloud assets, filter by port, and probe for HTTP servicescloudlist-silent|grep":80"|httpx-silent
# List cloud assets, probe for HTTP services, and scan for vulnerabilitiescloudlist-silent|httpx-silent|nuclei-tcves/
# List cloud assets from specific provider and scan for vulnerabilitiescloudlist-provideraws-silent|httpx-silent|nuclei-texposures/
# List cloud assets and scan for open portscloudlist-silent|naabu-silent
# List cloud assets and scan for specific portscloudlist-silent|naabu-p80,443,8080-silent
# Output only IP addressescloudlist-silent-format"\\\\{\\\\{.IP\\\\}\\\\}"# Output hostname and providercloudlist-silent-format"\\\\{\\\\{.Hostname\\\\}\\\\} (\\\\{\\\\{.Provider\\\\}\\\\})"# Output JSON with specific fieldscloudlist-json-format"\\\\{\\\\{.ID\\\\}\\\\},\\\\{\\\\{.Name\\\\}\\\\},\\\\{\\\\{.IP\\\\}\\\\},\\\\{\\\\{.Provider\\\\}\\\\}"
# Filter by IP addresscloudlist-silent|grep"192.168"# Filter by hostnamecloudlist-silent|grep"example.com"# Filter by providercloudlist-silent|grep"aws"# Filter by portcloudlist-silent|grep":443"
# Filter by instance typecloudlist-silent|grep"t2.micro"# Filter by storage typecloudlist-silent|grep"s3"# Filter by database typecloudlist-silent|grep"rds"
# Reduce concurrencycloudlist-concurrency5# Add delay between requestscloudlist-delay2
Permission Issues
# Check if credentials have sufficient permissions# For AWS, ensure the IAM user/role has the necessary read permissions# For Azure, ensure the service principal has the Reader role# For GCP, ensure the service account has the necessary viewer roles
No Results
# Check if provider is configured correctlycloudlist-list
# Try a different providercloudlist-providerazure
# Check if resources exist in the account
Cloudlist uses a configuration file located at $HOME/.config/cloudlist/config.yaml. You can customize various settings in this file:
# Example configuration fileproviders:-id:awsaws:access_key:AKIAIOSFODNN7EXAMPLEsecret_key:wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY-id:azureazure:client_id:00000000-0000-0000-0000-000000000000client_secret:EXAMPLE-SECRETtenant_id:00000000-0000-0000-0000-000000000000-id:gcpgcp:service_account_key:/path/to/service-account-key.json
This cheat sheet provides a comprehensive reference for using Cloudlist, from basic asset listing to advanced filtering and integration with other tools. For the most up-to-date information, always refer to the official documentation.