Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 14, 2026

Cloud Storage

Confirm exposed S3 buckets from a name list

s3scanner is a tool that finds open S3 buckets in AWS and other providers, checking buckets and hostnames for misconfigured or publicly accessible read and write permissions across endpoints such as AWS, DigitalOcean, and DreamHost.

installgo install -v github.com/sa7mon/s3scanner@latestbrew install s3scanner

Go · MIT license

Agent
Check bucket permissions at scaleDump the contents of open bucketsScan S3-compatible providers

overview

What s3scanner does

S3Scanner sits after bucket discovery. Feed --buckets-file a list of names; scan reports permission verdicts, dump downloads readable objects into a file and folder.

Operators reach for it when cloud_enum or s3reverse already produced candidates. It does not invent names. Public AllUsers READ or WRITE is the exposure signal to chase.

Unlike lazys3, it does not permute new names. Unlike cloud_enum, it does not discover across clouds. Its job is confirm-and-capture on a known list, including non-AWS via --endpoint-url.

source github.com/sa7mon/S3Scanner

use cases

Where s3scanner fits

Check bucket permissions at scale

Run scan mode over a file of bucket names to learn which grant public read or write access, without touching their contents.

Dump the contents of open buckets

Enable dump mode to download what an exposed bucket holds, capturing evidence of the data that was reachable.

Scan S3-compatible providers

Set --endpoint-url and --endpoint-address-style to check buckets on non-AWS object stores that speak the S3 API.

Thread a large candidate list

Raise --threads so a long list of bucket names produced by discovery is checked in parallel rather than one at a time.

reference

s3scanner inputs and flags

7 inputs
NameTypeFlagDescription
buckets-fileFILE--buckets-fileFile containing bucket names, one per line.
scanBOOLEANscanScan bucket permissions.
dumpBOOLEANdumpDump the contents of open buckets.
threadsSTRING--threadsNumber of threads to use (default 4).
endpoint-urlSTRING--endpoint-urlEndpoint URL for an S3-compatible provider.
endpoint-address-styleSTRING--endpoint-address-styleEndpoint address style: path or vhost.

Showing key inputs. s3scanner exposes 7 inputs in total.

Full flag reference (7 inputs)
NameTypeFlagDescription
scanBOOLEANscanScan bucket permissions.
dumpBOOLEANdumpDump the contents of open buckets.
buckets-fileFILE--buckets-fileFile containing bucket names, one per line.
threadsSTRING--threadsNumber of threads to use (default 4).
endpoint-urlSTRING--endpoint-urlEndpoint URL for an S3-compatible provider.
endpoint-address-styleSTRING--endpoint-address-styleEndpoint address style: path or vhost.
insecureBOOLEAN--insecureDo not verify SSL certificates.

example

Run s3scanner

s3scanner · command
# scan a candidate bucket list with 8 threads
s3scanner --buckets-file candidate-buckets.txt --threads 8 scan
sample output
example-static-assets    | bucket_exists     | AllUsers: [READ]           | AuthUsers: []
example-app-backups      | bucket_exists     | AllUsers: [READ, WRITE]    | AuthUsers: [FULL_CONTROL]
example-user-uploads     | bucket_exists     | AllUsers: []               | AuthUsers: [READ]
example-terraform-state  | bucket_exists     | AllUsers: []               | AuthUsers: []
example-cdn-logs         | bucket_not_exists |                            |
example-media-prod       | bucket_exists     | AllUsers: [READ, READ_ACP] | AuthUsers: []
example-legacy-site      | bucket_exists     | AllUsers: [READ]           | AuthUsers: []
example-invoices         | bucket_exists     | AllUsers: []               | AuthUsers: [WRITE]

guidance

Choosing s3scanner

Use when you already have bucket names and need permission checks or content dumps. Pair upstream with cloud_enum or s3reverse; use lazys3 if you still need name brute force.

s3reverse

Normalizes mixed bucket references into one format before scanning.

cloud_enum

Discovers cloud storage across AWS, Azure, and GCP to produce candidate buckets.

lazys3

Brute-forces S3 bucket names from permutations to surface new targets.

workflows

Workflows using s3scanner

1 workflow

  1. Cloud Bucket Finder (S3, GCS, Azure)

    Permute a keyword into candidate bucket names and check each anonymously across Amazon S3, Google Cloud, Azure Blob and DigitalOcean.

faq

s3scanner questions

Enable scan to report bucket permissions without reading objects. Enable dump to download files from buckets that scan marked readable. Run scan first to triage, then dump only the buckets that need evidence capture.

No. It reads existing names from --buckets-file and checks each one. Generate candidates with lazys3 or cloud_enum, or normalize mixed references with s3reverse, then feed that list in.

Yes. Set --endpoint-url to the provider endpoint and --endpoint-address-style to path or vhost. It scans any store that speaks the S3 API, not only Amazon.

Raise --threads above the default of 4 so names from the file are checked in parallel. Watch for provider rate limits when the thread count climbs.

After discovery and name normalization. Feed names from cloud_enum and s3reverse, run scan for exposure, dump the open ones for evidence, then route results onward.

related

More Cloud Storage tools

  1. mass3

    DNS existence check for a pre-compiled S3 bucket wordlist.

  2. s3reverse

    Normalize mixed S3 bucket references into one address format.

  3. scant3r

    Sweeps a URL list with module-based checks across multiple HTTP methods.

Run s3scanner yourself

A file of bucket names feeds S3Scanner, which checks each one's permissions and dumps the open buckets, writing the exposed results as a queryable output.

Open s3scanner in the libraryView the workflow

Facts on this page come from the live Trickest tool library.