# Cloud Pentesting

#### Manual Methods for Identifying S3 Buckets <a href="#f3b0" id="f3b0"></a>

**Using Browser URL Inspection:**

One of the simplest ways to check if a website is hosted on AWS is by entering the following in the browser URL bar:

```perl
Copy%c0
```

<figure><img src="https://miro.medium.com/v2/resize:fit:700/1*axzR338K5l1mDnumW6ok1A.jpeg" alt=""><figcaption></figcaption></figure>

If you encounter an XML error the website is likely hosted on Amazon AWS. To verify further use browser extensions like Wappalyzer to check for AWS-related technologies.

#### Checking the Source Code <a href="#id-985d" id="id-985d"></a>

Inspect the website source code and search for "s3" to find any hidden S3 bucket URLs. if you found any just open and check if there bucket listing is enabled.

![None](https://miro.medium.com/v2/resize:fit:700/1*u2BV1WXL_Wd1lLShGHjIHg.jpeg)![None](https://miro.medium.com/v2/resize:fit:700/1*DYHbnF5fK2XKvOd2PbkR6g.jpeg)

#### Google Dorking for AWS S3 Buckets <a href="#dcb5" id="dcb5"></a>

Google dorking helps uncover exposed S3 buckets. you can use the following dork to find open s3 buckets:

```vbnet
Copysite:s3.amazonaws.com "target.com"
site:*.s3.amazonaws.com "target.com"
site:s3-external-1.amazonaws.com "target.com"
site:s3.dualstack.us-east-1.amazonaws.com "target.com"
site:amazonaws.com inurl:s3.amazonaws.com 
site:s3.amazonaws.com intitle:"index of"  
site:s3.amazonaws.com inurl:".s3.amazonaws.com/"  
site:s3.amazonaws.com intitle:"index of" "bucket"

(site:*.s3.amazonaws.com OR site:*.s3-external-1.amazonaws.com OR site:*.s3.dualstack.us-east-1.amazonaws.com OR site:*.s3.ap-south-1.amazonaws.com) "target.com"
```

If bucket listing is enabled you'll be able to view the entire directory and its files. If you see an "Access Denied" message it means the bucket is private.

#### Automating Google Dorking with DorkEye <a href="#id-86ed" id="id-86ed"></a>

DorkEye automates Google dorking making reconnaissance faster by quickly extracting multiple AWS URLs for analysis.

[GitHub - BullsEye0/dorks-eye: Dorks Eye Google Hacking Dork Scraping and Searching Script. Dorks…Dorks Eye Google Hacking Dork Scraping and Searching Script. Dorks Eye is a script I made in python 3. With this tool…github.com](https://github.com/BullsEye0/dorks-eye)

<figure><img src="https://miro.medium.com/v2/resize:fit:700/1*w8ZEJbOwDBu5cxddc4B8Sw.jpeg" alt=""><figcaption></figcaption></figure>

#### Using S3Misconfig for Fast Bucket Enumeration <a href="#ffef" id="ffef"></a>

S3Misconfig scans a list of URLs for open S3 buckets with listing enabled and saves the results in a user friendly HTML format for easy review.

[GitHub - Atharv834/S3BucketMisconfContribute to Atharv834/S3BucketMisconf development by creating an account on GitHub.github.com](https://github.com/Atharv834/S3BucketMisconf)

<figure><img src="https://miro.medium.com/v2/resize:fit:700/1*wx_5hm39q3F5lqpSe_im5Q.jpeg" alt=""><figcaption></figcaption></figure>

#### Finding S3 Buckets with HTTPX and Nuclei <a href="#id-5857" id="id-5857"></a>

You can use the HTTPX command along with the Nuclei tool to quickly identify all S3 buckets across subdomains saving you significant time in recon.

```vbnet
Copyusing subfinder+HTTPX
subfinder -d target.com -all -silent | httpx-toolkit -sc -title -td | grep "Amazon S3"

Nuclei template:
subfinder -d target.com -all -silent | nuclei -t /home/coffinxp/.local/nuclei-templates/http/technologies/s3-detect.yaml
```

<figure><img src="https://miro.medium.com/v2/resize:fit:700/1*qTQ4DK9CyfSLcMWcFUmzaA.jpeg" alt=""><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:700/1*NmnvzSXA1uUfssFBUkIKWA.jpeg" alt=""><figcaption></figcaption></figure>

#### Extracting S3 URLs from JavaScript Files <a href="#b0d0" id="b0d0"></a>

Next we'll use the Katana tool to download JavaScript files from target subdomains and extract S3 URLs using the following grep command:

```bash
Copykatana -u https://site.com/ -d 5 -jc | grep '\.js$' | tee alljs.txt
cat alljs.txt | xargs -I {} curl -s {} | grep -oE 'http[s]?://[^"]*\.s3\.amazonaws\.com[^" ]*' | sort -u
```

[GitHub - projectdiscovery/katana: A next-generation crawling and spidering framework.A next-generation crawling and spidering framework. - projectdiscovery/katanagithub.com](https://github.com/projectdiscovery/katana)

#### Using java2s3 tool to find s3 urls in js files <a href="#id-9502" id="id-9502"></a>

Alternatively you can use this powerful approach to extract all S3 URLs from JavaScript files of subdomains. First combine Subfinder and HTTPX to generate the final list of subdomains then run the java2s3 tool for extraction.

```bash
Copysubfinder -d target.com -all -silent | httpx-toolkit -o file.txt
cat file.txt | grep -oP '(?<=https?:\/\/).*'
python java2s3.py input.txt target.com output.txt
cat output3.txt | grep -E "S3 Buckets: \['[^]]+"
cat output.txt | grep -oP 'https?://[a-zA-Z0-9.-]*s3(\.dualstack)?\.ap-[a-z0-9-]+\.amazonaws\.com/[^\s"<>]+' | sort -u
cat output3.txt | grep -oP '([a-zA-Z0-9.-]+\.s3(\.dualstack)?\.[a-z0-9-]+\.amazonaws\.com)' | sort -u
```

<figure><img src="https://miro.medium.com/v2/resize:fit:700/1*mFDGZ-qIqJ5yfndI5OTsJQ.jpeg" alt=""><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:700/1*pqC9rKvaQFug_EWxV6ucKg.jpeg" alt=""><figcaption></figcaption></figure>

<figure><img src="https://miro.medium.com/v2/resize:fit:700/1*0j06i80VcXoHABAhFRzufw.jpeg" alt=""><figcaption></figcaption></figure>

after this you can use use the S3Misconfig tool to identify publicly accessible S3 buckets with listing enabled by sending all these s3 urls to the tool

[GitHub - mexploit30/java2s3Contribute to mexploit30/java2s3 development by creating an account on GitHub.github.com](https://github.com/mexploit30/java2s3)

#### Brute-Forcing S3 Bucket with LazyS3 <a href="#id-988e" id="id-988e"></a>

You can also use this LazyS3 tool — it's basically a brute force tool for AWS S3 buckets using different permutations. you can run the following command by specifying the target domain

```xml
Copyruby lazys3.rb <COMPANY> 
```

[GitHub - nahamsec/lazys3Contribute to nahamsec/lazys3 development by creating an account on GitHub.github.com](https://github.com/nahamsec/lazys3)

<figure><img src="https://miro.medium.com/v2/resize:fit:700/1*iUwhnIahsqxHtjktldmvYw.jpeg" alt=""><figcaption></figcaption></figure>

#### Using Cewl + S3Scanner to find open buckets <a href="#badd" id="badd"></a>

Next use the Cewl tool to generate a custom wordlist from the target domain. Then run S3Scanner with the list to identify valid and invalid S3 buckets. Finally use a grep command to filter valid buckets based on permissions and size and inspect their contents using the AWS CLI.

```perl
Copycewl https://site.com/ -d 3 -w file.txt

s3scanner -bucket-file file.txt -enumerate -threads 10 | grep -aE 'AllUsers: \[.*(READ|WRITE|FULL).*]'
```

[GitHub - sa7mon/S3Scanner: Scan for misconfigured S3 buckets across S3-compatible APIs!Scan for misconfigured S3 buckets across S3-compatible APIs! - sa7mon/S3Scannergithub.com](https://github.com/sa7mon/S3Scanner)

<figure><img src="https://miro.medium.com/v2/resize:fit:700/1*rdvGquu0uRpw_cBh_KJgIA.jpeg" alt=""><figcaption></figcaption></figure>

#### Extracting S3 Buckets from GitHub Repositories <a href="#a35d" id="a35d"></a>

Use GitHub dorks to find AmazonAWS results in public repositories. Check S3 URLs for bucket listings and verify access with AWS CLI. If you discover sensitive data report it to bug bounty programs.

```vbnet
Copyorg:target "amazonaws"
org:target "bucket_name" 
org:target "aws_access_key"
org:target "aws_access_key_id"
org:target "aws_key"
org:target "aws_secret"
org:target "aws_secret_key"
org:target "S3_BUCKET"
```

<figure><img src="https://miro.medium.com/v2/resize:fit:700/1*woVUKNX5FuHbmh-rI2tbfg.jpeg" alt=""><figcaption></figcaption></figure>

#### Websites for Public S3 Bucket Discovery <a href="#id-357a" id="id-357a"></a>

Use these websites to search for files in public AWS buckets by keyword. Download and inspect the contents and if you find any sensitive files report them responsibly:

> grayhatwarfare:

[Public Buckets by GrayhatWarfareEdit descriptiongrayhatwarfare.com](https://buckets.grayhatwarfare.com/)

> osint.sh

<https://osint.sh/buckets/>

<figure><img src="https://miro.medium.com/v2/resize:fit:700/1*MJsAyjGQVWQE0UD-j9tlzg.jpeg" alt=""><figcaption></figcaption></figure>

#### Finding Hidden S3 URLs with Extensions <a href="#id-1bd7" id="id-1bd7"></a>

The S3BucketList Chrome extension scans web pages for exposed S3 URLs helping researchers quickly identify misconfigured buckets without manually inspecting the source code

[S3BucketList - Chrome Web StoreSearch, lists, and checks S3 Buckets found in network requestsgoogle.com](https://chromewebstore.google.com/detail/s3bucketlist/anngjobjhcbancaaogmlcffohpmcniki?hl=en)

<figure><img src="https://miro.medium.com/v2/resize:fit:700/1*Q2kWnYn7eaZUjFn_91Vv9g.jpeg" alt=""><figcaption></figcaption></figure>

#### AWS S3 Bucket Listing & File Management <a href="#b988" id="b988"></a>

Easily manage AWS S3 buckets with these AWS CLI commands. These commands help security researchers, penetration testers and cloud administrators list, copy, delete and download files for efficient storage management and security assessments.

**Reading Files:**

```perl
Copyaws s3 ls s3://[bucketname] --no-sign-request
```

**Copying Files:**

```perl
Copyaws s3 cp file.txt s3://[bucketname] --no-sign-request
```

**Deleting Files:**

```bash
Copyaws s3 rm s3://[bucketname]/file.txt --no-sign-request
```

**Downloading All Files:**

```perl
Copyaws s3 cp s3://[bucketname]/ ./ --recursive --no-sign-request
```

<figure><img src="https://miro.medium.com/v2/resize:fit:700/1*0Lzdbdr9MJj7ciuSjj8UWQ.jpeg" alt=""><figcaption></figcaption></figure>

> Buckets with "Full Control" permission allow file uploads and deletions which could lead to security risks. Always follow responsible disclosure policies when reporting vulnerabilities.
