Getting started

Knowledge hub

Tutorials

Concepts

Hostnames S3 Bucket Finder

Exposed cloud resources like storage buckets might contain important information no one should see. If these resources aren't properly protected, someone who shouldn't have access could get their hands on sensitive data, like passwords or personal information. This could lead to problems like data breaches or identity theft. \ \ This workflow finds your buckets based on the hostnames provided by using permutations and brute-forcing the bucket names.

Complexity: basic

Category: Attack Surface Management

Workflow

Hostnames S3 Bucket Finder

Tools

Setup

You can set up this workflow by changing following input value:

  • TARGETS - provide a file containing hostnames list, as a target

Workflow Targets Setup

Execution and results

After setup workflow is ready to be executed. Once workflow’s last node, get-buckets script, is finished result can be viewed and downloaded.

get-buckets script will contain all of the found buckets based on the hostnames provided.

Try it out!

This workflow is available in the Library, you can copy it and execute it immediately!

Improve this workflow

  • Brute-force through #batch-output
  • Add arbitrary credentials to check for bucket permissions
  • Download exposed files and directories on buckets found
  • Use notify to send message for newly found misconfigured buckets