Skip to content

s3-buckets-misconfigurations.md

Latest commit

 

History

History
90 lines (51 loc) · 2.53 KB

s3-buckets-misconfigurations.md

File metadata and controls

90 lines (51 loc) · 2.53 KB
Raw

S3 Buckets Misconfigurations

Step 1: Create an AWS Account

Step 2: Download and Install AWS CLI

{% embed url="https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-quickstart.html#cli-configure-quickstart-download" %}

Step 3: Configure AWS CLI

aws configure

Step 4: Interacting with S3 Buckets

List bucket contents: 
aws s3 ls s3://bucket-name

Download a file: 
aws s3 cp s3://bucket-name/file.png ./

Upload a file: 
aws s3 cp ./localfile.txt s3://bucket-name/poc.txt

Copy a File:
aws s3 cp test.txt s3://bucket_name

To move a file to a bucket:
aws s3 mv test.txt s3://bucket_name

Delete command:
aws s3 rm s3://qa-media.company/fileName.txt

To Dump Data:
aws s3 sync . s3://[bucketname]

Tools

{% embed url="https://github.com/sa7mon/S3Scanner" %}

Lazy S3

bucket_finder

AWS Cred Scanner

sandcastle

Mass3

Dumpster Diver

S3 Bucket Finder

Checklist

  • S3 Content Listing

{% embed url="https://hackerone.com/reports/1062803" %}

  • User's Can upload any files without limits

{% embed url="https://hackerone.com/reports/764243" %}

  • No Authentication on S3 bucket and can be accessed by any user

{% embed url="https://hackerone.com/reports/819278" %}

  • S3 bucket misconfig of pre-signed URLs

{% embed url="https://labs.detectify.com/writeups/bypassing-and-exploiting-bucket-upload-policies-and-signed-urls/" %}

https://www.youtube.com/watch?v=MBQJJ3jfJ8k

https://www.youtube.com/watch?v=G7Pre3Y46Fs

Another Resources

{% embed url="https://3bodymo.medium.com/how-i-earned-by-amazon-s3-bucket-misconfigurations-29d51ee510de" %}

{% embed url="https://medium.com/@janijay007/s3-bucket-misconfiguration-from-basics-to-pawn-6893776d1007" %}