Cloud Storage
Confirm exposed S3 buckets from a name list
Checks candidate S3 buckets for open permissions and can dump readable contents.
overview
What s3scanner does
S3Scanner sits after bucket discovery. Feed --buckets-file a list of names; scan reports permission verdicts, dump downloads readable objects into a file and folder.
Operators reach for it when cloud_enum or s3reverse already produced candidates. It does not invent names. Public AllUsers READ or WRITE is the exposure signal to chase.
Unlike lazys3, it does not permute new names. Unlike cloud_enum, it does not discover across clouds. Its job is confirm-and-capture on a known list, including non-AWS via --endpoint-url.
source github.com/sa7mon/S3Scanner
use cases
Where s3scanner fits
Check bucket permissions at scale
Run scan mode over a file of bucket names to learn which grant public read or write access, without touching their contents.
Dump the contents of open buckets
Enable dump mode to download what an exposed bucket holds, capturing evidence of the data that was reachable.
Scan S3-compatible providers
Set --endpoint-url and --endpoint-address-style to check buckets on non-AWS object stores that speak the S3 API.
Thread a large candidate list
Raise --threads so a long list of bucket names produced by discovery is checked in parallel rather than one at a time.
reference
s3scanner inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| buckets-file | FILE | --buckets-file | File containing bucket names, one per line. |
| scan | BOOLEAN | scan | Scan bucket permissions. |
| dump | BOOLEAN | dump | Dump the contents of open buckets. |
| threads | STRING | --threads | Number of threads to use (default 4). |
| endpoint-url | STRING | --endpoint-url | Endpoint URL for an S3-compatible provider. |
| endpoint-address-style | STRING | --endpoint-address-style | Endpoint address style: path or vhost. |
Showing key inputs. s3scanner exposes 7 inputs in total.
Full flag reference (7 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| scan | BOOLEAN | scan | Scan bucket permissions. |
| dump | BOOLEAN | dump | Dump the contents of open buckets. |
| buckets-file | FILE | --buckets-file | File containing bucket names, one per line. |
| threads | STRING | --threads | Number of threads to use (default 4). |
| endpoint-url | STRING | --endpoint-url | Endpoint URL for an S3-compatible provider. |
| endpoint-address-style | STRING | --endpoint-address-style | Endpoint address style: path or vhost. |
| insecure | BOOLEAN | --insecure | Do not verify SSL certificates. |
example
Run s3scanner
# scan a candidate bucket list with 8 threadss3scanner --buckets-file candidate-buckets.txt --threads 8 scanexample-static-assets | bucket_exists | AllUsers: [READ] | AuthUsers: []example-app-backups | bucket_exists | AllUsers: [READ, WRITE] | AuthUsers: [FULL_CONTROL]example-user-uploads | bucket_exists | AllUsers: [] | AuthUsers: [READ]example-terraform-state | bucket_exists | AllUsers: [] | AuthUsers: []example-cdn-logs | bucket_not_exists | |example-media-prod | bucket_exists | AllUsers: [READ, READ_ACP] | AuthUsers: []example-legacy-site | bucket_exists | AllUsers: [READ] | AuthUsers: []example-invoices | bucket_exists | AllUsers: [] | AuthUsers: [WRITE]guidance
Choosing s3scanner
Use when you already have bucket names and need permission checks or content dumps. Pair upstream with cloud_enum or s3reverse; use lazys3 if you still need name brute force.
s3reverse
Normalizes mixed bucket references into one format before scanning.
cloud_enum
Discovers cloud storage across AWS, Azure, and GCP to produce candidate buckets.
lazys3
Brute-forces S3 bucket names from permutations to surface new targets.
workflows
Workflows using s3scanner
faq
s3scanner questions
Run s3scanner yourself
A file of bucket names feeds S3Scanner, which checks each one's permissions and dumps the open buckets, writing the exposed results as a queryable output.
Facts on this page come from the live Trickest tool library.