loading
Loading content
loading
Cloud Storage
Checks candidate S3 buckets for open permissions and can dump readable contents.
overview
S3Scanner sits after bucket discovery. Feed --buckets-file a list of names; scan reports permission verdicts, dump downloads readable objects into a file and folder.
Operators reach for it when cloud_enum or s3reverse already produced candidates. It does not invent names. Public AllUsers READ or WRITE is the exposure signal to chase.
Unlike lazys3, it does not permute new names. Unlike cloud_enum, it does not discover across clouds. Its job is confirm-and-capture on a known list, including non-AWS via --endpoint-url.
source github.com/sa7mon/S3Scanner
use cases
Run scan mode over a file of bucket names to learn which grant public read or write access, without touching their contents.
Enable dump mode to download what an exposed bucket holds, capturing evidence of the data that was reachable.
Set --endpoint-url and --endpoint-address-style to check buckets on non-AWS object stores that speak the S3 API.
Raise --threads so a long list of bucket names produced by discovery is checked in parallel rather than one at a time.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| buckets-file | FILE | --buckets-file | File containing bucket names, one per line. |
| scan | BOOLEAN | scan | Scan bucket permissions. |
| dump | BOOLEAN | dump | Dump the contents of open buckets. |
| threads | STRING | --threads | Number of threads to use (default 4). |
| endpoint-url | STRING | --endpoint-url | Endpoint URL for an S3-compatible provider. |
| endpoint-address-style | STRING | --endpoint-address-style | Endpoint address style: path or vhost. |
Showing key inputs. s3scanner exposes 7 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| scan | BOOLEAN | scan | Scan bucket permissions. |
| dump | BOOLEAN | dump | Dump the contents of open buckets. |
| buckets-file | FILE | --buckets-file | File containing bucket names, one per line. |
| threads | STRING | --threads | Number of threads to use (default 4). |
| endpoint-url | STRING | --endpoint-url | Endpoint URL for an S3-compatible provider. |
| endpoint-address-style | STRING | --endpoint-address-style | Endpoint address style: path or vhost. |
| insecure | BOOLEAN | --insecure | Do not verify SSL certificates. |
example
# scan a candidate bucket list with 8 threadss3scanner --buckets-file candidate-buckets.txt --threads 8 scanexample-static-assets | bucket_exists | AllUsers: [READ] | AuthUsers: []example-app-backups | bucket_exists | AllUsers: [READ, WRITE] | AuthUsers: [FULL_CONTROL]example-user-uploads | bucket_exists | AllUsers: [] | AuthUsers: [READ]example-terraform-state | bucket_exists | AllUsers: [] | AuthUsers: []example-cdn-logs | bucket_not_exists | |example-media-prod | bucket_exists | AllUsers: [READ, READ_ACP] | AuthUsers: []example-legacy-site | bucket_exists | AllUsers: [READ] | AuthUsers: []example-invoices | bucket_exists | AllUsers: [] | AuthUsers: [WRITE]guidance
Use when you already have bucket names and need permission checks or content dumps. Pair upstream with cloud_enum or s3reverse; use lazys3 if you still need name brute force.
Normalizes mixed bucket references into one format before scanning.
Discovers cloud storage across AWS, Azure, and GCP to produce candidate buckets.
Brute-forces S3 bucket names from permutations to surface new targets.
faq
A file of bucket names feeds S3Scanner, which checks each one's permissions and dumps the open buckets, writing the exposed results as a queryable output.
Facts on this page come from the live Trickest tool library.