loading
Loading content
loading
Cloud Storage
DNS existence check for a pre-compiled S3 bucket wordlist.
overview
mass3 reads a -w wordlist of candidate bucket hostnames and resolves each over DNS with -r resolvers. Names that answer are written to a FILE and FOLDER. -t sets thread count (default 10).
Use it when the candidate list is large and you only need existence before a permissions pass. It does not check ACLs or fetch objects.
Trickest runs mass3 as a managed Cloud Storage node. Hand resolved buckets to s3scanner for access checks. Build the wordlist upstream with lazys3 or cloud_enum.
source github.com/smiegles/mass3
use cases
Feed a pre-compiled list of bucketname.s3.amazonaws.com entries with -w and let mass3 keep only the names that answer a DNS query, so a million-line wordlist collapses to the buckets that exist.
Supply a resolvers file with -r so the DNS queries fan out instead of hammering a single server, which keeps a large run fast and avoids rate limits on one resolver.
Run mass3 first to find which candidate buckets resolve, then pass that shorter list to S3Scanner so the expensive permission checks only run against real buckets.
Raise the thread count with -t to push more concurrent DNS lookups, matching the run time to how big the bucket wordlist is and how much resolver capacity you have.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| bucket-list | FILE | -w | Wordlist of pre-compiled S3 buckets (bucketname.s3.amazonaws.com). |
| resolvers-list | FILE | -r | File listing the DNS resolvers to spread queries across. |
| threads | STRING | -t | Number of threads to use. Default: 10. |
Showing key inputs. mass3 exposes 3 inputs in total.
example
# resolve a pre-compiled bucket wordlist over DNS with 100 threadsmass3 -w s3-buckets.txt -r resolvers.txt -t 100example-assets.s3.amazonaws.comexample-media.s3.amazonaws.comexample-backups.s3.amazonaws.comexample-static.s3.amazonaws.comexample-logs.s3.amazonaws.comexample-uploads.s3.amazonaws.comexample-cdn.s3.amazonaws.com… (7 resolved buckets also written to out.csv)guidance
Use mass3 when you have a pre-compiled S3 bucket wordlist and want a DNS pass to learn which names exist. It does not check permissions or read contents. Feed resolved buckets to s3scanner. Generate candidates upstream with lazys3 or cloud_enum.
Checks bucket permissions and dumps open ones over HTTP. Run after mass3.
Builds candidate bucket names from permutations for mass3 to resolve.
Normalizes mixed bucket references into one format before enumeration.
faq
A bucket wordlist and a resolvers list feed mass3, which resolves each name over DNS and writes the buckets that exist as a queryable output.
Facts on this page come from the live Trickest tool library.