Amazon Simple Storage Service (S3) is the AWS service offering object-level storage for users and organizations.
Recon Tools
S3 Recon
s3enum
lazys3
BucketLoot
Bucket inspector that can help users extract assets, flag secret exposures and even search for custom keywords as well as Regular Expressions from publicly-exposed storage buckets by scanning files that store data in plain-text.
By default, the AWS CLI includes prefix= (an empty prefix) and delimiter=/ in requests
Check for https://target.com.s3.amazonaws.com/?prefix=&delimiter=/
List bucket content - Anon
aws s3 ls s3://dev.target.com --no-sign-request
aws s3 ls s3://dev.target.com --no-sign-request --recursive
If you found an URL like http://target.s3.eu-west-2.amazonaws.com remove the s3.region.amazonaws.com part
aws s3 ls s3://target --no-sign-request
By default AWS cli tool interacts with s3.amazonaws.com . If you have another domain hosting
it, you can use --endpoint-url option to point the tool to another domain.
You do not have to always necessarily change an ACL to test for write permissions if read permissions are enabled. You can simply check the "Grants" property in the response to a read operation and verify if any unauthorized users are allowed to perform the write operation!
S3 Versioning
curl -sI http://target.s3.region.com/statis/js/auth.js
# Look for x-amz-id header
Disclaimer: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.
Advanced Penetration Testing: Hacking AWS 2
This book delves deeper into analyzing the security of various AWS services and shows techniques and tactics used by an attacker to breach an AWS environment
