Friday, August 21, 2020

goGetBucket - A Penetration Testing Tool To Enumerate And Analyse Amazon S3 Buckets Owned By A Domain


When performing a recon on a domain - understanding assets they own is very important. AWS S3 bucket permissions have been confused time and time again, and have allowed for the exposure of sensitive material.

What this tool does, is enumerate S3 bucket names using common patterns I have identified during my time bug hunting and pentesting. Permutations are supported on a root domain name using a custom wordlist. I highly recommend the one packaged within AltDNS.

The following information about every bucket found to exist will be returned:
  • List Permission
  • Write Permission
  • Region the Bucket exists in
  • If the bucket has all access disabled

Installation
go get -u github.com/glen-mac/goGetBucket

Usage
goGetBucket -m ~/tools/altdns/words.txt -d <domain> -o <output> -i <wordlist>
Usage of ./goGetBucket:
  -d string
        Supplied domain name (used with mutation flag)
  -f string
        Path to a testfile (default "/tmp/test.file")
  -i string
        Path to input wordlist to enumerate
  -k string
        Keyword list (used with mutation flag)
  -m string
        Path to mutation wordlist (requires domain flag)
  -o string
        Path to output file to store log
  -t int
        Number of concurrent threads (default 100)
Throughout my use of the tool, I have produced the best results when I feed in a list (-i) of subdomains for a root domain I am interested in. E.G:
www.domain.com
mail.domain.com
dev.domain.com
The test file (-f) is a file that the script will attempt to store in the bucket to test write permissions. So maybe store your contact information and a warning message if this is performed during a bounty?
The keyword list (-k) is concatenated with the root domain name (-d) and the domain without the TLD to permutate using the supplied permuation wordlist (-m).
Be sure not to increase the threads too high (-t) - as the AWS has API rate limiting that will kick in and start giving an undesired return code.

More articles


  1. Hacker Tools Free Download
  2. Hacking Tools For Kali Linux
  3. Install Pentest Tools Ubuntu
  4. Free Pentest Tools For Windows
  5. Pentest Tools Github
  6. Pentest Tools Review
  7. Hacking Tools 2019
  8. Hack Tools
  9. Hacking Tools Name
  10. Hacking Tools 2020
  11. Hack Tools For Ubuntu
  12. Hackrf Tools
  13. Termux Hacking Tools 2019
  14. Github Hacking Tools
  15. Tools For Hacker
  16. Hack Tools Pc
  17. Hack Tools Download
  18. Hacker Search Tools
  19. Hacking Tools
  20. Easy Hack Tools
  21. Hack Tools For Ubuntu
  22. Hacking Tools Name
  23. Hackrf Tools
  24. How To Make Hacking Tools
  25. Hack Tools For Pc
  26. Hacking Tools For Beginners
  27. Hack App
  28. Pentest Tools Github
  29. Pentest Tools Nmap
  30. What Is Hacking Tools
  31. Hack Tools
  32. Blackhat Hacker Tools
  33. Hacker Tools For Ios
  34. Hacker Tools Free
  35. Best Hacking Tools 2019
  36. Hacking Tools Name
  37. Hacking Tools Hardware
  38. Usb Pentest Tools
  39. Hackers Toolbox
  40. Black Hat Hacker Tools
  41. New Hack Tools
  42. Hacker Tools For Ios
  43. Pentest Tools Website
  44. Hacker Tools Free
  45. Hack Tool Apk No Root
  46. Hack Tools Pc
  47. What Is Hacking Tools
  48. Hacking Tools Free Download
  49. Pentest Automation Tools
  50. Pentest Tools Free
  51. Hacker Tools For Ios
  52. Growth Hacker Tools
  53. Pentest Tools
  54. Hack Tools For Games
  55. Hacker Search Tools
  56. Hacking Tools Windows 10
  57. Hacker Tools Github
  58. Pentest Tools Website Vulnerability
  59. Hacking App
  60. Hack App
  61. Hacker Tools For Windows
  62. Pentest Tools Free
  63. Pentest Tools Website Vulnerability
  64. Hacking Tools Hardware
  65. Pentest Tools Download
  66. What Is Hacking Tools
  67. Pentest Tools Apk
  68. Easy Hack Tools
  69. Nsa Hack Tools
  70. Pentest Tools Alternative
  71. Github Hacking Tools
  72. Tools 4 Hack
  73. Hack Tools Github
  74. Hacker Tools Windows
  75. Nsa Hack Tools Download
  76. Free Pentest Tools For Windows
  77. Nsa Hacker Tools
  78. Hacker Tools Free
  79. Tools For Hacker
  80. Pentest Tools Bluekeep
  81. Hacking Tools Windows
  82. Hack Tools Github
  83. Github Hacking Tools
  84. Hack Tools Download
  85. Hacker Tools Free Download
  86. Hacker Tools Windows
  87. New Hacker Tools
  88. Pentest Tools Linux
  89. Pentest Tools Apk
  90. Hack App
  91. Hacker Tools Windows
  92. Hacking Tools And Software
  93. Hack Tools
  94. Hacker Tools 2019
  95. Hacker Tools 2020
  96. Pentest Tools Bluekeep
  97. Pentest Tools Website
  98. World No 1 Hacker Software
  99. Nsa Hack Tools
  100. Hacker Tools Software
  101. Game Hacking
  102. Hacking Tools For Windows
  103. Kik Hack Tools
  104. Pentest Tools Port Scanner
  105. New Hacker Tools
  106. Pentest Tools Bluekeep
  107. Android Hack Tools Github
  108. Install Pentest Tools Ubuntu
  109. Pentest Tools
  110. Hacker Tools Mac
  111. Hacker Tools Linux
  112. Pentest Tools Apk
  113. Best Hacking Tools 2020
  114. Hacking Tools Software
  115. Hacker Tools Apk Download
  116. Hacker
  117. Pentest Tools Website Vulnerability
  118. Hacking Tools Github
  119. Hacking Tools For Kali Linux
  120. World No 1 Hacker Software
  121. Hack Tools For Windows
  122. Hacking Tools And Software
  123. Hack Tools Github
  124. Pentest Tools Tcp Port Scanner
  125. Hacker Tools Online
  126. Hack Tools For Windows
  127. Hacking Tools For Mac
Posted by at

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)