vamp-cloud-enum 1.0__tar.gz → 1.2__tar.gz

vamp_cloud_enum-1.2/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 VampSecure Studios
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

{vamp_cloud_enum-1.0 → vamp_cloud_enum-1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vamp-cloud-enum
-Version: 1.0
+Version: 1.2
 Summary: Cloud asset enumeration and exposure analysis for authorized audits
 Author-email: VampSecure Studios <contact@vampsecurestudios.com>
 License: MIT
@@ -16,11 +16,14 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Topic :: Security
 Requires-Python: >=3.9
 Description-Content-Type: text/markdown
+License-File: LICENSE
 Requires-Dist: aiohttp>=3.9.0
 Requires-Dist: rich>=13.7.0
+Dynamic: license-file
 
+<!-- © VampSecure Studios — VampSecure Labs Security Research Division -->
 <p align="center">
-  <img src="https://img.shields.io/badge/version-1.0-crimson?style=flat-square" />
+  <img src="https://img.shields.io/badge/version-1.1-crimson?style=flat-square" />
   <img src="https://img.shields.io/badge/python-3.11+-blue?style=flat-square&logo=python&logoColor=white" />
   <img src="https://img.shields.io/badge/providers-AWS%20%7C%20Azure%20%7C%20GCP-teal?style=flat-square" />
   <img src="https://img.shields.io/badge/VampSecure_Labs-Security_Research-8b0000?style=flat-square" />
@@ -69,6 +72,13 @@ pip install -r requirements.txt
 
 ## Installation
 
+
+```bash
+pip install vamp-cloud-enum
+# o con Homebrew:
+brew install vampsecure-labs/labs/vamp-cloud-enum
+```
+
 ```bash
 git clone https://github.com/belky-me/vamp-cloud-enum.git
 cd vamp-cloud-enum
@@ -186,3 +196,8 @@ python vamp_cloud_enum.py -d example.com -d example-cdn.com \
   © VampSecure Studios — VampSecure Labs Security Research Division<br/>
   For authorized security assessments only. Unauthorized use is prohibited.
 </p>
+
+---
+
+## Versión
+v1.1 — VampSecure Labs Security Research Division

{vamp_cloud_enum-1.0 → vamp_cloud_enum-1.2}/README.md

@@ -1,5 +1,6 @@
+<!-- © VampSecure Studios — VampSecure Labs Security Research Division -->
 <p align="center">
-  <img src="https://img.shields.io/badge/version-1.0-crimson?style=flat-square" />
+  <img src="https://img.shields.io/badge/version-1.1-crimson?style=flat-square" />
   <img src="https://img.shields.io/badge/python-3.11+-blue?style=flat-square&logo=python&logoColor=white" />
   <img src="https://img.shields.io/badge/providers-AWS%20%7C%20Azure%20%7C%20GCP-teal?style=flat-square" />
   <img src="https://img.shields.io/badge/VampSecure_Labs-Security_Research-8b0000?style=flat-square" />
@@ -48,6 +49,13 @@ pip install -r requirements.txt
 
 ## Installation
 
+
+```bash
+pip install vamp-cloud-enum
+# o con Homebrew:
+brew install vampsecure-labs/labs/vamp-cloud-enum
+```
+
 ```bash
 git clone https://github.com/belky-me/vamp-cloud-enum.git
 cd vamp-cloud-enum
@@ -165,3 +173,8 @@ python vamp_cloud_enum.py -d example.com -d example-cdn.com \
   © VampSecure Studios — VampSecure Labs Security Research Division<br/>
   For authorized security assessments only. Unauthorized use is prohibited.
 </p>
+
+---
+
+## Versión
+v1.1 — VampSecure Labs Security Research Division

{vamp_cloud_enum-1.0 → vamp_cloud_enum-1.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "vamp-cloud-enum"
-version = "1.0"
+version = "1.2"
 description = "Cloud asset enumeration and exposure analysis for authorized audits"
 readme = "README.md"
 license = { text = "MIT" }

{vamp_cloud_enum-1.0 → vamp_cloud_enum-1.2}/vamp_cloud_enum.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vamp-cloud-enum
-Version: 1.0
+Version: 1.2
 Summary: Cloud asset enumeration and exposure analysis for authorized audits
 Author-email: VampSecure Studios <contact@vampsecurestudios.com>
 License: MIT
@@ -16,11 +16,14 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Topic :: Security
 Requires-Python: >=3.9
 Description-Content-Type: text/markdown
+License-File: LICENSE
 Requires-Dist: aiohttp>=3.9.0
 Requires-Dist: rich>=13.7.0
+Dynamic: license-file
 
+<!-- © VampSecure Studios — VampSecure Labs Security Research Division -->
 <p align="center">
-  <img src="https://img.shields.io/badge/version-1.0-crimson?style=flat-square" />
+  <img src="https://img.shields.io/badge/version-1.1-crimson?style=flat-square" />
   <img src="https://img.shields.io/badge/python-3.11+-blue?style=flat-square&logo=python&logoColor=white" />
   <img src="https://img.shields.io/badge/providers-AWS%20%7C%20Azure%20%7C%20GCP-teal?style=flat-square" />
   <img src="https://img.shields.io/badge/VampSecure_Labs-Security_Research-8b0000?style=flat-square" />
@@ -69,6 +72,13 @@ pip install -r requirements.txt
 
 ## Installation
 
+
+```bash
+pip install vamp-cloud-enum
+# o con Homebrew:
+brew install vampsecure-labs/labs/vamp-cloud-enum
+```
+
 ```bash
 git clone https://github.com/belky-me/vamp-cloud-enum.git
 cd vamp-cloud-enum
@@ -186,3 +196,8 @@ python vamp_cloud_enum.py -d example.com -d example-cdn.com \
   © VampSecure Studios — VampSecure Labs Security Research Division<br/>
   For authorized security assessments only. Unauthorized use is prohibited.
 </p>
+
+---
+
+## Versión
+v1.1 — VampSecure Labs Security Research Division

{vamp_cloud_enum-1.0 → vamp_cloud_enum-1.2}/vamp_cloud_enum.egg-info/SOURCES.txt

@@ -1,3 +1,4 @@
+LICENSE
 README.md
 pyproject.toml
 vamp_cloud_enum.py

{vamp_cloud_enum-1.0 → vamp_cloud_enum-1.2}/vamp_cloud_enum.py

@@ -3,7 +3,7 @@
 vamp_cloud_enum.py — Enumerador de Buckets/Blobs Cloud Públicos
 ================================================================
 VampSecure Labs · VampSecure Studios
-Para Uso Exclusivo en Pruebas de Penetración Autorizadas — v1.0
+Para Uso Exclusivo en Pruebas de Penetración Autorizadas — v1.1
 
 DESCRIPCIÓN GENERAL
 -------------------
@@ -99,19 +99,19 @@ from vampsec_report import (
 # CONSTANTES Y CONFIGURACIÓN
 # =============================================================================
 
-VERSION   = "1.0"
+VERSION   = "1.2"
 TOOL_NAME = "vamp-cloud-enum"
 AUTHOR    = "© VampSecure Studios — VampSecure Labs Security Research Division"
 
 console = Console()
 
 BANNER = r"""
-__   ___   __  __ ___  ___ ___ ___ _   _ ___ ___ _      _   ___ ___ 
+__   ___   __  __ ___  ___ ___ ___ _   _ ___ ___ _      _   ___ ___
 \ \ / /_\ |  \/  | _ \/ __| __/ __| | | | _ \ __| |    /_\ | _ ) __|
  \ V / _ \| |\/| |  _/\__ \ _| (__| |_| |   / _|| |__ / _ \| _ \__ \
   \_/_/ \_\_|  |_|_|  |___/___\___|\___/|_|_\___|____/_/ \_\___/___/
   by Antonio Hernandez "Belky" — VampSecure Studios
-  vamp-cloud-enum v1.0 · Cloud Bucket Enumerator
+  vamp-cloud-enum v1.2 · Cloud Bucket Enumerator
   ────────────────────────────────────────────────────────────────────────
   USO EXCLUSIVO EN AUDITORÍAS AUTORIZADAS · El uso no autorizado es ilegal
 """
@@ -1428,6 +1428,25 @@ def parse_args() -> argparse.Namespace:
         dest="html_out",
         help="Guardar informe HTML dark-theme",
     )
+    p.add_argument(
+        "--check-misconfigs",
+        action="store_true",
+        dest="check_misconfigs",
+        help=(
+            "Comprobar malas configuraciones en S3/Azure/GCS sin credenciales "
+            "(acceso público, listado de contenedores) — v1.1"
+        ),
+    )
+    p.add_argument(
+        "--check-functions",
+        action="store_true",
+        dest="check_functions",
+        help=(
+            "Comprobar exposición de funciones serverless: AWS Lambda function URLs "
+            "y Azure Function Apps. Genera muchas peticiones (usa con precaución). "
+            "Hallazgos: AWS_LAMBDA_URL_EXPOSED, AZURE_FUNCTION_EXPOSED — v1.2"
+        ),
+    )
 
     add_report_args(p)
     return p.parse_args()
@@ -1461,10 +1480,317 @@ def _load_wordlist(path: str) -> List[str]:
         return []
 
 
+# =============================================================================
+# COMPROBACIÓN DE EXPOSICIÓN DE FUNCIONES SERVERLESS (v1.2)
+# =============================================================================
+
+# Regiones AWS más comunes para Lambda function URLs
+_AWS_LAMBDA_REGIONES: List[str] = [
+    "us-east-1", "us-east-2", "us-west-1", "us-west-2",
+    "eu-west-1", "eu-west-2", "eu-central-1",
+    "ap-southeast-1", "ap-southeast-2", "ap-northeast-1",
+]
+
+# Funciones Azure habituales a probar (variantes del nombre del endpoint)
+_AZURE_FUNC_NOMBRES: List[str] = [
+    "api", "function", "func", "http", "trigger", "webhook",
+    "process", "handler", "main", "app",
+]
+
+
+def _generar_candidatos_lambda(dominios: List[str]) -> List[str]:
+    """
+    Genera candidatos para el ID de Lambda function URL usando partes del dominio.
+
+    Los function URL IDs de AWS Lambda son cadenas de 26 caracteres aleatorias
+    y no se pueden predecir. Esta función genera candidatos basados en las partes
+    del dominio para detectar funciones con nombres personalizados o patrones
+    predecibles que algunas organizaciones configuran.
+
+    Retorna lista de candidatos únicos (en minúsculas, solo alfanuméricos y guiones).
+    """
+    candidatos: set = set()
+    for dominio in dominios:
+        # Extraer parte principal del dominio (sin TLD)
+        partes = dominio.rstrip(".").split(".")
+        # Usar el nombre del dominio sin TLD y sin subdominios secundarios
+        if len(partes) >= 2:
+            nombre = partes[-2]
+        else:
+            nombre = partes[0]
+        # Normalizar: solo alfanuméricos y guiones
+        import re as _re
+        nombre_norm = _re.sub(r"[^a-z0-9\-]", "-", nombre.lower())
+        nombre_norm = _re.sub(r"-+", "-", nombre_norm).strip("-")
+        if not nombre_norm:
+            continue
+
+        candidatos.add(nombre_norm)
+        # Variantes comunes
+        for sfx in ("api", "func", "lambda", "fn", "app", "service", "svc", "handler"):
+            candidatos.add(f"{nombre_norm}-{sfx}")
+            candidatos.add(f"{sfx}-{nombre_norm}")
+
+    return list(candidatos)
+
+
+def _check_lambda_function_urls(
+    dominios: List[str],
+    findings: List[BucketResult],
+) -> None:
+    """
+    Prueba URLs de funciones Lambda AWS en busca de endpoints públicamente accesibles.
+
+    Realiza peticiones HEAD a `https://<candidato>.lambda-url.<región>.on.aws/`
+    para detectar funciones con URLs públicas habilitadas.
+
+    Severidad:
+      HIGH — Respuesta 200 (función accesible sin autenticación)
+      MEDIUM — Respuesta 403 (función existe pero requiere autenticación)
+    """
+    import urllib.request  as _ureq
+    import urllib.error    as _uerr
+
+    candidatos = _generar_candidatos_lambda(dominios)
+
+    for candidato in candidatos:
+        for region in _AWS_LAMBDA_REGIONES:
+            url = f"https://{candidato}.lambda-url.{region}.on.aws/"
+            try:
+                req = _ureq.Request(
+                    url,
+                    method="HEAD",
+                    headers={"User-Agent": f"VampSecureLabs/{VERSION}"},
+                )
+                with _ureq.urlopen(req, timeout=8) as resp:
+                    codigo = resp.status
+                    if codigo == 200:
+                        findings.append(BucketResult(
+                            name=candidato, provider="aws-lambda", url=url,
+                            status="PUBLIC", http_code=codigo,
+                            headers=dict(resp.headers),
+                            body_snippet=f"Lambda URL pública (200 OK) — {region}",
+                            severity="HIGH",
+                            finding_id="AWS_LAMBDA_URL_EXPOSED",
+                        ))
+            except _uerr.HTTPError as exc:
+                if exc.code == 403:
+                    # 403 confirma que la función existe (pero requiere auth)
+                    findings.append(BucketResult(
+                        name=candidato, provider="aws-lambda", url=url,
+                        status="FORBIDDEN", http_code=403,
+                        headers={},
+                        body_snippet=f"Lambda URL existe pero requiere autenticación (403) — {region}",
+                        severity="MEDIUM",
+                        finding_id="AWS_LAMBDA_URL_EXPOSED",
+                    ))
+            except _uerr.URLError:
+                # DNS NXDOMAIN u otro error de red: la función no existe con ese nombre/región
+                pass
+            except Exception:
+                pass
+
+
+def _check_azure_function_apps(
+    dominios: List[str],
+    findings: List[BucketResult],
+) -> None:
+    """
+    Prueba endpoints de Azure Function Apps en busca de funciones accesibles sin auth.
+
+    Realiza peticiones GET a `https://<nombre>.azurewebsites.net/api/<func>?code=`
+    donde <nombre> se genera a partir de los dominios objetivo y <func> es una
+    lista de nombres habituales de funciones HTTP trigger.
+
+    Severidad:
+      HIGH — Respuesta 200 (función accesible sin código de autorización)
+    """
+    import urllib.request  as _ureq
+    import urllib.error    as _uerr
+    import re              as _re
+
+    # Generar nombres de Function App candidatos a partir de los dominios
+    app_names: List[str] = []
+    for dominio in dominios:
+        partes = dominio.rstrip(".").split(".")
+        if len(partes) >= 2:
+            nombre = partes[-2]
+        else:
+            nombre = partes[0]
+        nombre_norm = _re.sub(r"[^a-z0-9\-]", "-", nombre.lower())
+        nombre_norm = _re.sub(r"-+", "-", nombre_norm).strip("-")
+        if not nombre_norm:
+            continue
+        app_names.append(nombre_norm)
+        # Variantes comunes de Function App
+        for sfx in ("api", "functions", "func", "app", "service"):
+            app_names.append(f"{nombre_norm}-{sfx}")
+            app_names.append(f"{sfx}-{nombre_norm}")
+
+    for app_name in app_names:
+        for func_nombre in _AZURE_FUNC_NOMBRES:
+            # Probar sin código de autorización (debería devolver 401/403 si es seguro)
+            url = f"https://{app_name}.azurewebsites.net/api/{func_nombre}?code="
+            try:
+                req = _ureq.Request(
+                    url,
+                    headers={"User-Agent": f"VampSecureLabs/{VERSION}"},
+                )
+                with _ureq.urlopen(req, timeout=8) as resp:
+                    codigo = resp.status
+                    if codigo == 200:
+                        cuerpo = resp.read(256).decode("utf-8", errors="ignore")
+                        findings.append(BucketResult(
+                            name=f"{app_name}/{func_nombre}", provider="azure-functions", url=url,
+                            status="PUBLIC", http_code=codigo,
+                            headers=dict(resp.headers),
+                            body_snippet=cuerpo[:200],
+                            severity="HIGH",
+                            finding_id="AZURE_FUNCTION_EXPOSED",
+                        ))
+            except _uerr.HTTPError as exc:
+                # 401/403 = función existe pero requiere auth → no es hallazgo
+                # 404 = función no existe → silencioso
+                pass
+            except _uerr.URLError:
+                # DNS NXDOMAIN: Function App no existe → silencioso
+                break  # Si el dominio no resuelve, saltar todas las funciones del mismo app_name
+            except Exception:
+                pass
+
+
 # =============================================================================
 # FUNCIÓN PRINCIPAL
 # =============================================================================
 
+# =============================================================================
+# COMPROBACIONES DE MALA CONFIGURACIÓN (v1.1) — urllib.request sin credenciales
+# =============================================================================
+
+def _check_s3_public_access(
+    bucket_names: List[str],
+    findings: List[BucketResult],
+) -> None:
+    """
+    Comprueba acceso público en buckets S3 sin credenciales (v1.1).
+
+    Realiza peticiones GET anónimas a las URLs canónicas de S3 y clasifica
+    el resultado según la respuesta HTTP.
+
+    Severidad:
+      CRITICAL — La respuesta contiene ListBucketResult (listado público)
+      HIGH     — Respuesta 200 OK sin listado (contenido accesible)
+      INFO     — 403/404 (bucket privado o inexistente)
+    """
+    import urllib.request
+    import urllib.error
+
+    for nombre in bucket_names:
+        url_raiz = f"https://{nombre}.s3.amazonaws.com/"
+        try:
+            req = urllib.request.Request(
+                url_raiz, headers={"User-Agent": f"VampSecureLabs/{VERSION}"}
+            )
+            with urllib.request.urlopen(req, timeout=10) as resp:
+                codigo  = resp.status
+                cuerpo  = resp.read(512).decode("utf-8", errors="ignore")
+                if "ListBucketResult" in cuerpo:
+                    findings.append(BucketResult(
+                        name=nombre, provider="s3", url=url_raiz,
+                        status="LISTING", http_code=codigo,
+                        headers={}, body_snippet=cuerpo[:200],
+                        severity="CRITICAL", finding_id="CLOUD-MC-S3-001",
+                    ))
+                else:
+                    findings.append(BucketResult(
+                        name=nombre, provider="s3", url=url_raiz,
+                        status="PUBLIC", http_code=codigo,
+                        headers={}, body_snippet=cuerpo[:200],
+                        severity="HIGH", finding_id="CLOUD-MC-S3-002",
+                    ))
+        except urllib.error.HTTPError as exc:
+            if exc.code not in (403, 404):
+                # Error inesperado; ignorar silenciosamente
+                pass
+        except Exception:
+            # Error de red o DNS; ignorar
+            pass
+
+
+def _check_azure_blob_public(
+    storage_accounts: List[str],
+    findings: List[BucketResult],
+) -> None:
+    """
+    Comprueba acceso público en cuentas Azure Blob Storage sin credenciales (v1.1).
+
+    Realiza peticiones GET anónimas a la API de listado de contenedores.
+
+    Severidad:
+      HIGH — La respuesta XML contiene EnumerationResults (listado público)
+    """
+    import urllib.request
+    import urllib.error
+
+    for cuenta in storage_accounts:
+        url = f"https://{cuenta}.blob.core.windows.net/?comp=list"
+        try:
+            req = urllib.request.Request(
+                url, headers={"User-Agent": f"VampSecureLabs/{VERSION}"}
+            )
+            with urllib.request.urlopen(req, timeout=10) as resp:
+                codigo = resp.status
+                cuerpo = resp.read(512).decode("utf-8", errors="ignore")
+                if "EnumerationResults" in cuerpo:
+                    findings.append(BucketResult(
+                        name=cuenta, provider="azure", url=url,
+                        status="LISTING", http_code=codigo,
+                        headers={}, body_snippet=cuerpo[:200],
+                        severity="HIGH", finding_id="CLOUD-MC-AZ-001",
+                    ))
+        except urllib.error.HTTPError:
+            pass  # 403/404 esperado para cuentas privadas
+        except Exception:
+            pass  # Error de red
+
+
+def _check_gcs_public(
+    bucket_names: List[str],
+    findings: List[BucketResult],
+) -> None:
+    """
+    Comprueba acceso público en buckets GCS sin credenciales (v1.1).
+
+    Realiza peticiones GET anónimas a la API JSON de Cloud Storage.
+
+    Severidad:
+      HIGH — La respuesta JSON 200 devuelve metadatos del bucket (acceso público)
+    """
+    import urllib.request
+    import urllib.error
+
+    for nombre in bucket_names:
+        url = f"https://storage.googleapis.com/{nombre}?alt=json"
+        try:
+            req = urllib.request.Request(
+                url, headers={"User-Agent": f"VampSecureLabs/{VERSION}"}
+            )
+            with urllib.request.urlopen(req, timeout=10) as resp:
+                codigo = resp.status
+                cuerpo = resp.read(512).decode("utf-8", errors="ignore")
+                if codigo == 200:
+                    findings.append(BucketResult(
+                        name=nombre, provider="gcp", url=url,
+                        status="PUBLIC", http_code=codigo,
+                        headers={}, body_snippet=cuerpo[:200],
+                        severity="HIGH", finding_id="CLOUD-MC-GCS-001",
+                    ))
+        except urllib.error.HTTPError:
+            pass  # 403/404 esperado para buckets privados
+        except Exception:
+            pass  # Error de red
+
+
 async def run(args: argparse.Namespace) -> int:
     """
     Orquesta la enumeración completa de buckets cloud.
@@ -1538,6 +1864,58 @@ async def run(args: argparse.Namespace) -> int:
     )
     all_results.append(result)
 
+    # ── Comprobaciones de mala configuración (v1.1) ───────────────────────────
+    if getattr(args, "check_misconfigs", False) and args.domains:
+        console.print("\n[bold cyan]Comprobando malas configuraciones cloud (sin credenciales)…[/]\n")
+        misconfig_findings: List[BucketResult] = []
+        # Generar nombres de bucket candidatos a partir de los dominios objetivo
+        nombres_mc: List[str] = []
+        for dominio in args.domains:
+            norm = re.sub(r"[^a-z0-9\-]", "-", dominio.lower().strip())
+            norm = re.sub(r"-+", "-", norm).strip("-")
+            if norm:
+                nombres_mc.append(norm)
+
+        if "s3" in providers:
+            _check_s3_public_access(nombres_mc, misconfig_findings)
+        if "azure" in providers:
+            _check_azure_blob_public(nombres_mc, misconfig_findings)
+        if "gcp" in providers:
+            _check_gcs_public(nombres_mc, misconfig_findings)
+
+        if misconfig_findings:
+            console.print(
+                f"  [yellow]Malas configuraciones detectadas:[/] {len(misconfig_findings)}"
+            )
+            found_all.extend(misconfig_findings)
+        else:
+            console.print("  [green]Sin malas configuraciones detectadas.[/]")
+
+    # ── Comprobaciones de exposición serverless (v1.2) ────────────────────────
+    if getattr(args, "check_functions", False) and args.domains:
+        console.print(
+            "\n[bold cyan]Comprobando exposición de funciones serverless "
+            "(Lambda URLs + Azure Functions)…[/]\n"
+        )
+        function_findings: List[BucketResult] = []
+
+        if "s3" in providers:
+            # Lambda es parte del ecosistema AWS (misma opción de proveedor que S3)
+            console.print("  [dim]→ AWS Lambda function URLs…[/]")
+            _check_lambda_function_urls(args.domains, function_findings)
+
+        if "azure" in providers:
+            console.print("  [dim]→ Azure Function Apps…[/]")
+            _check_azure_function_apps(args.domains, function_findings)
+
+        if function_findings:
+            console.print(
+                f"  [yellow]Funciones serverless expuestas:[/] {len(function_findings)}"
+            )
+            found_all.extend(function_findings)
+        else:
+            console.print("  [green]Sin funciones serverless expuestas detectadas.[/]")
+
     # ── Salida en consola ─────────────────────────────────────────────────────
     print_summary_table(found_all)
     print_critical_panels(found_all)