Cloud Storage
Find which S3 bucket names resolve over DNS
DNS existence check for a pre-compiled S3 bucket wordlist.
overview
What mass3 does
mass3 reads a -w wordlist of candidate bucket hostnames and resolves each over DNS with -r resolvers. Names that answer are written to a FILE and FOLDER. -t sets thread count (default 10).
Use it when the candidate list is large and you only need existence before a permissions pass. It does not check ACLs or fetch objects.
Trickest runs mass3 as a managed Cloud Storage node. Hand resolved buckets to s3scanner for access checks. Build the wordlist upstream with lazys3 or cloud_enum.
source github.com/smiegles/mass3
use cases
Where mass3 fits
Resolve a huge bucket wordlist over DNS
Feed a pre-compiled list of bucketname.s3.amazonaws.com entries with -w and let mass3 keep only the names that answer a DNS query, so a million-line wordlist collapses to the buckets that exist.
Spread lookups across your own resolvers
Supply a resolvers file with -r so the DNS queries fan out instead of hammering a single server, which keeps a large run fast and avoids rate limits on one resolver.
Front-load discovery before a permissions scan
Run mass3 first to find which candidate buckets resolve, then pass that shorter list to S3Scanner so the expensive permission checks only run against real buckets.
Tune throughput for the list size
Raise the thread count with -t to push more concurrent DNS lookups, matching the run time to how big the bucket wordlist is and how much resolver capacity you have.
reference
mass3 inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| bucket-list | FILE | -w | Wordlist of pre-compiled S3 buckets (bucketname.s3.amazonaws.com). |
| resolvers-list | FILE | -r | File listing the DNS resolvers to spread queries across. |
| threads | STRING | -t | Number of threads to use. Default: 10. |
Showing key inputs. mass3 exposes 3 inputs in total.
example
Run mass3
# resolve a pre-compiled bucket wordlist over DNS with 100 threadsmass3 -w s3-buckets.txt -r resolvers.txt -t 100example-assets.s3.amazonaws.comexample-media.s3.amazonaws.comexample-backups.s3.amazonaws.comexample-static.s3.amazonaws.comexample-logs.s3.amazonaws.comexample-uploads.s3.amazonaws.comexample-cdn.s3.amazonaws.com… (7 resolved buckets also written to out.csv)guidance
Choosing mass3
Use mass3 when you have a pre-compiled S3 bucket wordlist and want a DNS pass to learn which names exist. It does not check permissions or read contents. Feed resolved buckets to s3scanner. Generate candidates upstream with lazys3 or cloud_enum.
s3scanner
Checks bucket permissions and dumps open ones over HTTP. Run after mass3.
lazys3
Builds candidate bucket names from permutations for mass3 to resolve.
s3reverse
Normalizes mixed bucket references into one format before enumeration.
faq
mass3 questions
Run mass3 yourself
A bucket wordlist and a resolvers list feed mass3, which resolves each name over DNS and writes the buckets that exist as a queryable output.
Facts on this page come from the live Trickest tool library.