loading
Loading content
loading
Cloud Storage
Quickly enumerate a pre-compiled list of AWS S3 buckets using DNS instead of HTTP.
overview
mass3 checks a pre-compiled list of candidate S3 bucket names by resolving each one over DNS rather than sending an HTTP request. A bucket that exists answers a DNS query for its endpoint, so mass3 reads a wordlist of bucketname.s3.amazonaws.com entries, fires the lookups across your own list of resolvers, and prints the names that resolve. Trading HTTP for DNS keeps each check cheap, which is what lets it grind through a huge wordlist fast.
Because it leans on DNS, mass3 wants two files: the bucket wordlist (-w) and a resolvers list (-r) to spread the queries across. The thread count (-t) drives concurrency, so raising it clears a bigger list in the same window. mass3 surfaces which buckets exist and writes the hits to a CSV; confirming what each one exposes is a job for a permissions scanner downstream.
On Trickest, mass3 is a Cloud Storage node that takes a bucket wordlist and a resolvers list and writes a file and a folder of resolved buckets. Run it early to turn a million-line name list into the buckets that resolve, then hand those to a scanner like S3Scanner to check access and capture contents.
source github.com/smiegles/mass3
use cases
Feed a pre-compiled list of bucketname.s3.amazonaws.com entries with -w and let mass3 keep only the names that answer a DNS query, so a million-line wordlist collapses to the buckets that exist.
Supply a resolvers file with -r so the DNS queries fan out instead of hammering a single server, which keeps a large run fast and avoids rate limits on one resolver.
Run mass3 first to find which candidate buckets resolve, then pass that shorter list to S3Scanner so the expensive permission checks only run against real buckets.
Raise the thread count with -t to push more concurrent DNS lookups, matching the run time to how big the bucket wordlist is and how much resolver capacity you have.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| bucket-list | FILE | -w | Wordlist of pre-compiled S3 buckets (bucketname.s3.amazonaws.com). |
| resolvers-list | FILE | -r | File listing the DNS resolvers to spread queries across. |
| threads | STRING | -t | Number of threads to use. Default: 10. |
Showing key inputs. mass3 exposes 3 inputs in total.
example
# resolve a pre-compiled bucket wordlist over DNS with 100 threadsmass3 -w s3-buckets.txt -r resolvers.txt -t 100example-assets.s3.amazonaws.comexample-media.s3.amazonaws.comexample-backups.s3.amazonaws.comexample-static.s3.amazonaws.comexample-logs.s3.amazonaws.comexample-uploads.s3.amazonaws.comexample-cdn.s3.amazonaws.com… (7 resolved buckets also written to out.csv)guidance
Reach for mass3 when you have a large pre-compiled S3 bucket wordlist and want a fast DNS pass to learn which names exist. It does not check permissions or read contents, so feed its resolved buckets to S3Scanner for that. To generate the candidate names in the first place, run lazys3 or cloud_enum upstream.
Checks bucket permissions and dumps open ones. Run it after mass3 to confirm exposure over HTTP.
Brute-forces bucket names from permutations to build the wordlist mass3 resolves.
Normalizes mixed bucket references into one format before enumeration.
faq
A bucket wordlist and a resolvers list feed mass3, which resolves each name over DNS and writes the buckets that exist as a queryable output.
Facts on this page come from the live Trickest tool library.