Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 14, 2026

Discovery

Sweep S3 buckets for readable sensitive keys

List and flag sensitive keys across many S3 buckets.

Agent
Find readable buckets in a target's namespaceSurface sensitive files at scaleGenerate and test bucket-name guesses

overview

What aws-s3-data-finder does

aws-s3-data-finder walks a bucket-name set from -nl or -n, lists keys it can read, and flags backups, PII dumps, and credential-looking files among them.

Run --unauthenticated with --endpoint for public HTTP probes, or authenticated through the AWS CLI for account-region access. Cap how many keys you pull with -nk.

Trickest runs it as a managed Discovery node: bucket list in, FILE and FOLDER out with listable dumps under buckets/. Chain a name generator upstream and a secret scanner like noseyparker downstream.

source github.com/Ucnt/aws-s3-data-finder

use cases

Where aws-s3-data-finder fits

Find readable buckets in a target's namespace

Run a list of candidate bucket names unauthenticated over HTTP to see which ones list, then capture their keys for review.

Surface sensitive files at scale

Dump keys from listable buckets and let the tool flag backups, PII, and credential files instead of reading every object name by hand.

Generate and test bucket-name guesses

Use the random, brute-force, prefix, and postfix options to expand a seed into many candidate names and probe each one.

Audit your own S3 exposure

Run authenticated through the AWS CLI against your account's region to confirm which buckets are listable and what data they expose.

reference

aws-s3-data-finder inputs and flags

18 inputs
NameTypeFlagDescription
buckets-listFILE-nlList of bucket names to run.
bucket-nameSTRING-nA single bucket name to run.
unauthenticatedBOOLEAN--unauthenticatedRun the search unauthenticated, via web request.
endpointSTRING--endpointEndpoint to use for an unauth scan (auth scan uses the awscli region).
num-keysSTRING-nkNumber of keys to get per bucket.
charactersSTRING--charactersCharacters to run via random or brute force, e.g. abcdefg.
prefix-postfixSTRING-ppRun with prefixes and/or postfixes: prefix, postfix, or both.
realert-previouslyBOOLEAN--realertRe-alert on previously alerted suspicious files.

Showing key inputs. aws-s3-data-finder exposes 18 inputs in total.

Full flag reference (18 inputs)
NameTypeFlagDescription
verboseBOOLEAN-vPrint verbose output (critical messages and errors).
very-verboseBOOLEAN-vvPrint very verbose output (critical, errors, and warnings).
endpointSTRING--endpointEndpoint to use for an unauth scan; an auth scan uses the region in awscli.
num-keysSTRING-nkNumber of keys to get per bucket.
test-modeBOOLEAN--testTest mode that only prints the bucket names being run.
charactersSTRING--charactersCharacters to run via random or brute force, e.g. abcdefg.
bucket-nameSTRING-nA single bucket name to run.
start-afterSTRING-saFor all-chars mode, start after this string.
buckets-listFILE-nlList of bucket names to run.
run-all-charsBOOLEAN-acRun all character combinations.
prefix-postfixSTRING-ppRun with prefixes and/or postfixes: prefix, postfix, or both.
unauthenticatedBOOLEAN--unauthenticatedRun the search unauthenticated, via web request.
ignore-redirectsBOOLEAN--no_follow_redirectDo not follow HTTP redirects.
rerun-previouslyBOOLEAN--rerunRerun previously searched buckets.
run-random-charsBOOLEAN-rcRun random characters.
bucket-name-lengthSTRING-ncLength of the bucket name to generate.
print-bucket-namesBOOLEAN-pPrint bucket names as you go.
realert-previouslyBOOLEAN--realertRe-alert on previously alerted suspicious files.

example

Run aws-s3-data-finder

aws-s3-data-finder · command
# unauthenticated sweep of a candidate bucket list over HTTPaws-s3-data-finder -nl bucket-names.txt --unauthenticated --endpoint https://s3.amazonaws.com -nk 5000
sample output
[*] Loaded 1200 bucket names, mode=unauthenticated[+] Listable: example-backups  (2481 keys)[!] Suspicious (backup): example-backups/db-dump-2026-05.sql.gz[!] Suspicious (pii): example-backups/users-export.csv[+] Listable: example-assets  (940 keys)[!] Suspicious (credentials): example-assets/.env.production[*] Wrote buckets/example-backups.json[*] Wrote buckets/example-assets.json[*] Done: 2 listable, 3 suspicious across 1200 names

guidance

Choosing aws-s3-data-finder

Use aws-s3-data-finder to sweep many S3 buckets for readable, sensitive data, authenticated or not. It lists and flags keys; it does not deeply parse secrets, so chain a secret scanner after it. For existence checks only, use s3scanner.

s3scanner

Checks bucket existence and permissions across providers. aws-s3-data-finder goes further: dumps and flags contents.

cloud-enum

Discovers exposed cloud resources broadly, not just S3. Find buckets first, then read them here.

mass3

Bulk S3 enumeration sibling for working through large name lists.

faq

aws-s3-data-finder questions

Not always. Pass --unauthenticated to test public buckets over HTTP against --endpoint, or run authenticated through the AWS CLI to use your account region and access.

related

More Discovery tools

  1. apkurlgrep

    Extract URLs and endpoints from Android APK files.

  2. cariddi

    Crawl a domain list and scan responses for endpoints, secrets, tokens, and juicy files.

  3. crawlergo

    Browser-driven crawler that harvests requests for downstream scanners.

  4. dirsearch

    Web path scanner.

  5. fallparams

    Crawl pages, harvest potential parameters, write a custom wordlist.

  6. feroxbuster

    Recursive content discovery with smart defaults and rich response filters.

Run aws-s3-data-finder yourself

A bucket-name list feeds aws-s3-data-finder, which dumps keys from readable buckets and passes them to noseyparker to confirm leaked secrets as findings.

Open aws-s3-data-finder in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.