Common Use Cases

Common Use Cases

This page covers the five core workflows most operators use, from broad enumeration through OpenGraph attack-path analysis.

Table of Contents

• Use Case 1: Enumerate Everything Path
• Use Case 2: Multi-Region Enumeration
• Use Case 3: Enumerating Within an Identity Domain
• Use Case 4: OpenGraph Attack-Path Analysis
• Use Case 5: Targeted Service Enumeration with Downloads
• Use Case 6: Download DevOps Repositories

Use Case 1: Enumerate Everything Path

Use this when you want broad coverage quickly and need to see what your current credentials can access.

1. Load credentials into OCInferno.

   • See Authentication Reference for all auth modes.

2. Validate credentials and compartment context:

creds list
creds swap <CRED_NAME>
compartments list
compartments set

3. Enumerate compartment tree and all services, build OpenGraph, and download lightweight metadata (configs, IAM policies, small descriptors — not bulk content like bucket blobs or vault secrets):

modules run enum_all --comp --opengraph --download metadata

4. Review what was collected:

creds info
data export excel --out-dir ./report_excel

5. If you want configuration findings on top of the enumerated data:

modules run process_config_check

Use Case 2: Multi-Region Enumeration

Use this when the tenancy spans multiple subscribed regions and you want full coverage. By default, enum_all runs in the session's current region only.

Discover all subscribed regions and enumerate across all of them in one step:

modules run enum_all --comp --find-regions --opengraph --download metadata

--find-regions calls list_region_subscriptions, persists the results, then runs every service across every subscribed region in that same invocation. Global services (IAM, identity domains, compartments) always run in the home region only — the flag does not affect them.

Scope to specific regions manually:

modules run enum_all --comp --regions us-ashburn-1,us-phoenix-1 --download metadata

Check which regions were discovered:

configs list

Use Case 3: Enumerating Within an Identity Domain

Use this when your credential is an Identity Domain (IDD) user and enum_identity can't resolve the domain automatically — typically because you don't have permission to call ListIdentityDomains (the API that discovers domain endpoints). In that situation the IDD sub-components silently get no domain URLs and return nothing. A common example of this is having zero OCI IAM permissions with all of your access granted exclusively within the identity domain itself via app roles.

Find your domain URL first. In the OCI Console, sign in and open the user profile menu (top-right) → Identity Domain → copy the domain URL shown on the overview page (format: https://idcs-HASH.identity.oraclecloud.com). Alternatively, go to Identity & Security → Domains → click your domain → copy the Domain URL.

Supply the URL directly when enumerating:

# Enumerate everything — no component flags needed, all components run by default
modules run enum_identity --domain-urls https://idcs-HASH.identity.oraclecloud.com

# Add --save-domains to persist the URL to the DB so future runs find it automatically
modules run enum_identity --domain-urls https://idcs-HASH.identity.oraclecloud.com --save-domains

# Multiple domains
modules run enum_identity \
  --domain-urls https://idcs-HASH1.identity.oraclecloud.com \
               https://idcs-HASH2.identity.oraclecloud.com --save-domains

# Narrow to specific components if you only want a subset
modules run enum_identity --principals --idd-api-keys \
  --domain-urls https://idcs-HASH.identity.oraclecloud.com

Add --save-domains the first time you run with a new domain URL — subsequent enum_identity calls in the same workspace will find it automatically without needing --domain-urls again.

From enum_all (if you know the domain URL up front and want it included in a broader run):

modules run enum_all --comp --modules identity \
  --domain-urls https://idcs-HASH.identity.oraclecloud.com

Use Case 4: OpenGraph Attack-Path Analysis

After either of the workflows above, generate OpenGraph JSON for BloodHound CE path analysis.

1. If you haven't already run --opengraph in your enum_all, build the graph now:

modules run process_oracle_cloud_hound_data --reset --out opengraph.json

2. (Optional, first-time setup) Push custom node styling to BloodHound. Grab a bearer token from an authenticated BloodHound session (Network tab → any request → Authorization header):

modules run process_og_node_color_images \
  --push-custom-node-attributes-url http://127.0.0.1:8080/api/v2/custom-nodes \
  --push-custom-node-attributes-token <BLOODHOUND_BEARER_TOKEN>

3. Import opengraph.json into BloodHound CE and review:
   • Identity-to-resource relationships
   • Privilege-escalation chains
   • Inherited-access paths

For CE setup, use the SpecterOps quickstart: https://bloodhound.specterops.io/get-started/quickstart/community-edition-quickstart

Tip: The default export path (without --out) is: ./ocinferno_output/<workspace>/exports/opengraph/<compartment_or_tenancy_ocid>/bloodhound/oracle_cloud_hound.json

Use Case 5: Targeted Service Enumeration with Downloads

Use this when you want to enumerate specific services only, or pull bulk content (vault secrets, bucket objects, artifacts) for a focused investigation.

Enumerate one or more services and download their content:

# Vault secrets only
modules run enum_all --comp --modules vault --download vault_secrets

# Object Storage bucket objects
modules run enum_all --comp --modules object_storage --download buckets

# DevOps + Resource Manager configs
modules run enum_all --comp --modules devops,resource_manager --download devops_pipeline_config,orm_variables

Download all content-class artifacts (vault secrets, bucket blobs, artifacts, etc.):

modules run enum_all --comp --download content

Download everything except object storage (common when storage buckets are large):

modules run enum_all --comp --download --not-downloads object_storage

Check what tokens are available and what they download:

• See Downloads to Disk for the full token reference and per-module download inventory.
• Run modules run enum_all --list-modules to list every --modules service token.

Parallelize across services for speed (useful for large tenancies):

modules run enum_all --comp --parallel-services 4 --download metadata

Resume an interrupted run: if enum_all was interrupted, re-run with --resume <token> to continue from where it left off. List available resume tokens with modules run enum_all --list-tokens.

Use Case 6: Download DevOps Repositories

Use this when DevOps enumeration reveals code repositories worth searching for hardcoded credentials, Terraform state, database connection strings, or other sensitive material.

1. Enumerate DevOps to populate the repository list:

modules run enum_devops --repositories

2. Clone all discovered repositories to disk:

modules run exploit_devops_repositories_download

Repositories land under ocinferno_output/<workspace>/downloads/devops/repositories/.

Authentication: the module prefers SSH, using your active credential's RSA signing key — no auth token consumed. If the credential has no key file (e.g. an instance or resource principal), it falls back to HTTPS and creates a temporary auth token automatically.

Pre-store an auth token to avoid the auto-create step (useful when manage auth-tokens in tenancy is unavailable or you want to reuse an existing token):

configs auth-tokens list
configs auth-tokens add --token-id TOKEN_ID --token-value TOKEN_VALUE

For full flag reference see exploit_devops_repositories_download.