Sec-88
Ctrlk
  • 🧑Whoami
  • 🕸️Web-AppSec
  • ✉️API-Sec
  • 📱Android-AppSec
  • IOS-AppSec
  • 📶Network-Sec
  • 💻Desktop AppSec
  • ☁️Cloud Sec
    • Salesforce Hacking
    • Firebase
    • S3 Buckets Misconfigurations
    • Amazon Cognito Misconfiguraitons
  • 👨‍💻Programming
  • 🖥️Operating Systems
  • ✍️Write-Ups
Powered by GitBook
On this page
Edit
  1. ☁️Cloud Sec

S3 Buckets Misconfigurations

Step 1: Create an AWS Account

  • Visit the AWS website (https://aws.amazon.com) and create a free account

Step 2: Download and Install AWS CLI

LogoConfiguring settings for the AWS CLI - AWS Command Line InterfaceAWS Command Line Interface

Step 3: Configure AWS CLI

Step 4: Interacting with S3 Buckets

Tools

LogoGitHub - sa7mon/S3Scanner: Scan for misconfigured S3 buckets across S3-compatible APIs!GitHub

Lazy S3

bucket_finder

AWS Cred Scanner

sandcastle

Mass3

Dumpster Diver

S3 Bucket Finder

Checklist

LogoU.S. Dept Of Defense disclosed on HackerOne: Misconfigured AWS S3...HackerOne
LogoBCM Messenger disclosed on HackerOne: API - Amazon S3 bucket...HackerOne
LogoGreenhouse.io disclosed on HackerOne: Open S3 Bucket Accessible by...HackerOne
LogoBypassing and exploiting Bucket Upload Policies and Signed URLsLabs Detectify

https://www.youtube.com/watch?v=MBQJJ3jfJ8k

https://www.youtube.com/watch?v=G7Pre3Y46Fs

Another Resources

  • https://awsdocs.s3.amazonaws.com/S3/latest/s3-qrc.pdf

LogoHow I earned $$$$ by Amazon S3 Bucket misconfigurations?Medium
LogoS3 Bucket Misconfiguration: From Basics to PawnMedium
  • https://www.youtube.com/watch?v=tvWLgvK3QWo&list=PLWDPse9uXlgPBpf_dY0M9bIE_8f6MUO6c

PreviousFirebaseNextAmazon Cognito Misconfiguraitons

Last updated 1 year ago

Was this helpful?

  • Step 1: Create an AWS Account
  • Step 2: Download and Install AWS CLI
  • Step 3: Configure AWS CLI
  • Step 4: Interacting with S3 Buckets
  • Tools
  • Checklist
  • Another Resources

Was this helpful?

aws configure
List bucket contents: 
aws s3 ls s3://bucket-name

Download a file: 
aws s3 cp s3://bucket-name/file.png ./

Upload a file: 
aws s3 cp ./localfile.txt s3://bucket-name/poc.txt

Copy a File:
aws s3 cp test.txt s3://bucket_name

To move a file to a bucket:
aws s3 mv test.txt s3://bucket_name

Delete command:
aws s3 rm s3://qa-media.company/fileName.txt

To Dump Data:
aws s3 sync . s3://[bucketname]