Discovery
Sweep S3 buckets for readable sensitive keys
List and flag sensitive keys across many S3 buckets.
Python · MIT license
overview
What aws-s3-data-finder does
aws-s3-data-finder walks a bucket-name set from -nl or -n, lists keys it can read, and flags backups, PII dumps, and credential-looking files among them.
Run --unauthenticated with --endpoint for public HTTP probes, or authenticated through the AWS CLI for account-region access. Cap how many keys you pull with -nk.
Trickest runs it as a managed Discovery node: bucket list in, FILE and FOLDER out with listable dumps under buckets/. Chain a name generator upstream and a secret scanner like noseyparker downstream.
use cases
Where aws-s3-data-finder fits
Find readable buckets in a target's namespace
Run a list of candidate bucket names unauthenticated over HTTP to see which ones list, then capture their keys for review.
Surface sensitive files at scale
Dump keys from listable buckets and let the tool flag backups, PII, and credential files instead of reading every object name by hand.
Generate and test bucket-name guesses
Use the random, brute-force, prefix, and postfix options to expand a seed into many candidate names and probe each one.
Audit your own S3 exposure
Run authenticated through the AWS CLI against your account's region to confirm which buckets are listable and what data they expose.
reference
aws-s3-data-finder inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| buckets-list | FILE | -nl | List of bucket names to run. |
| bucket-name | STRING | -n | A single bucket name to run. |
| unauthenticated | BOOLEAN | --unauthenticated | Run the search unauthenticated, via web request. |
| endpoint | STRING | --endpoint | Endpoint to use for an unauth scan (auth scan uses the awscli region). |
| num-keys | STRING | -nk | Number of keys to get per bucket. |
| characters | STRING | --characters | Characters to run via random or brute force, e.g. abcdefg. |
| prefix-postfix | STRING | -pp | Run with prefixes and/or postfixes: prefix, postfix, or both. |
| realert-previously | BOOLEAN | --realert | Re-alert on previously alerted suspicious files. |
Showing key inputs. aws-s3-data-finder exposes 18 inputs in total.
Full flag reference (18 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| verbose | BOOLEAN | -v | Print verbose output (critical messages and errors). |
| very-verbose | BOOLEAN | -vv | Print very verbose output (critical, errors, and warnings). |
| endpoint | STRING | --endpoint | Endpoint to use for an unauth scan; an auth scan uses the region in awscli. |
| num-keys | STRING | -nk | Number of keys to get per bucket. |
| test-mode | BOOLEAN | --test | Test mode that only prints the bucket names being run. |
| characters | STRING | --characters | Characters to run via random or brute force, e.g. abcdefg. |
| bucket-name | STRING | -n | A single bucket name to run. |
| start-after | STRING | -sa | For all-chars mode, start after this string. |
| buckets-list | FILE | -nl | List of bucket names to run. |
| run-all-chars | BOOLEAN | -ac | Run all character combinations. |
| prefix-postfix | STRING | -pp | Run with prefixes and/or postfixes: prefix, postfix, or both. |
| unauthenticated | BOOLEAN | --unauthenticated | Run the search unauthenticated, via web request. |
| ignore-redirects | BOOLEAN | --no_follow_redirect | Do not follow HTTP redirects. |
| rerun-previously | BOOLEAN | --rerun | Rerun previously searched buckets. |
| run-random-chars | BOOLEAN | -rc | Run random characters. |
| bucket-name-length | STRING | -nc | Length of the bucket name to generate. |
| print-bucket-names | BOOLEAN | -p | Print bucket names as you go. |
| realert-previously | BOOLEAN | --realert | Re-alert on previously alerted suspicious files. |
example
Run aws-s3-data-finder
# unauthenticated sweep of a candidate bucket list over HTTP
aws-s3-data-finder -nl bucket-names.txt --unauthenticated --endpoint https://s3.amazonaws.com -nk 5000[*] Loaded 1200 bucket names, mode=unauthenticated
[+] Listable: example-backups (2481 keys)
[!] Suspicious (backup): example-backups/db-dump-2026-05.sql.gz
[!] Suspicious (pii): example-backups/users-export.csv
[+] Listable: example-assets (940 keys)
[!] Suspicious (credentials): example-assets/.env.production
[*] Wrote buckets/example-backups.json
[*] Wrote buckets/example-assets.json
[*] Done: 2 listable, 3 suspicious across 1200 namesguidance
Choosing aws-s3-data-finder
Use aws-s3-data-finder to sweep many S3 buckets for readable, sensitive data, authenticated or not. It lists and flags keys; it does not deeply parse secrets, so chain a secret scanner after it. For existence checks only, use s3scanner.
s3scanner
Checks bucket existence and permissions across providers. aws-s3-data-finder goes further: dumps and flags contents.
cloud-enum
Discovers exposed cloud resources broadly, not just S3. Find buckets first, then read them here.
mass3
Bulk S3 enumeration sibling for working through large name lists.
faq
aws-s3-data-finder questions
related
More Discovery tools
apkurlgrep
Extract URLs and endpoints from Android APK files.
cariddi
Crawl a domain list and scan responses for endpoints, secrets, tokens, and juicy files.
crawlergo
Browser-driven crawler that harvests requests for downstream scanners.
dirsearch
Web path scanner.
fallparams
Crawl pages, harvest potential parameters, write a custom wordlist.
feroxbuster
Recursive content discovery with smart defaults and rich response filters.
Run aws-s3-data-finder yourself
A bucket-name list feeds aws-s3-data-finder, which dumps keys from readable buckets and passes them to noseyparker to confirm leaked secrets as findings.
Facts on this page come from the live Trickest tool library.