使用s3sec批量化自动扫描S3存储桶泄露数据

下载

git clone https://github.com/0xmoot/s3sec

使用例

检查单个 S3 实例：

echo "test-instance.s3.amazonaws.com" | python3 s3sec.py

或者：

echo "test-instance" | python3 s3sec.py

检查 S3 实例列表：

cat locations | python3 s3sec.py

查找

设置字典，这里随便输入点

搞事情

想找的全、多，就设置几百万条字典

访问

下载对应资源

不过很多无用的垃圾文件，比如上图这个链接视频

摔跤？

也可以绑亚马逊号

安装 AWS CLI

pip3 install awscli

在 Kali Linux 上配置 AWS CLI

启动终端并输入以下命令，然后输入在前面步骤中创建的 AWS 访问密钥 ID 和 AWS 秘密访问密钥。
aws configure
使用以下默认设置：
AWS Access Key Id: <<Your Key>>
AWS Secret Access Key: <<Your Secret Access Key>>
Default region name: ap-south-1
Default output format: json

工具源码:

s3sec.py

#
#
#   s3sec developed by 0xmoot
#
#   Test AWS S3 instances for read/write/delete access
#   Usage: cat locations | python3 s3sec.py
#
#   0xmoot.com
#   twitter.com/0xmoot
#
#   Found a bug bounty using this tool? Feel free to add me as a collaborator: 0xmoot
#
#import sys
import requests
import subprocess
import os
import urllib3urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)print("     _____               ", file=sys.stderr)
print(" ___|___ / ___  ___  ___ ", file=sys.stderr)
print("/ __| |_ \/ __|/ _ \/ __|", file=sys.stderr)
print("\__ \___) \__ \  __/ (__ ", file=sys.stderr)
print("|___/____/|___/\___|\___|", file=sys.stderr)
print("", file=sys.stderr)
print("    0xmoot.com", file=sys.stderr)
print("    twitter.com/0xmoot", file=sys.stderr)
print("", file=sys.stderr)
print("Found a bug bounty using this tool?", file=sys.stderr)
print("Feel free to add me as a collaborator: 0xmoot :)", file=sys.stderr)
print("", file=sys.stderr)
print("Disclaimer: Use with caution. You are responsible for your actions.", file=sys.stderr)
print("Developers assume no liability and are not responsible for any misuse or damage.", file=sys.stderr)
print("Usage: cat locations | python3 s3sec.py", file=sys.stderr)
print("", file=sys.stderr)class http_obj:status_code: inttext: str_url: strdef http_get(url):data = http_obj()data._url = urldata.text = ""headers = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36','connection': 'close'}try:r = requests.get(url, headers=headers, verify=False, timeout=3)data.status_code = r.status_codedata.text = r.textexcept:data.status_code = -1return dataadded = []
def process(url, protocol="https"):b = http_get(protocol+"://"+url+".s3.amazonaws.com")if(b.text.find("<Error><Code>")>=0):code = b.text.split("<Error><Code>")[1].split("</Code>")[0]print(url+".s3.amazonaws.com [error: "+code+"]")if(code == "AccessDenied"):try:#falls back to aws cli to test access with --no-sign-request argumentsubprocess.check_output([str('aws'), 's3', 'ls', 's3://'+url, '--no-sign-request'],stderr=subprocess.DEVNULL)print(url+".s3.amazonaws.com [read (--no-sign-request)]")except:returnreturnelif(b.text.find("ListBucketResult")>=0):print(url+".s3.amazonaws.com [read]")else:if(protocol=="http"):print(url+".s3.amazonaws.com [error: ConnectionError("+str(b.status_code)+")]")else:#try connecting to http insteadprocess(url,"http")returntry:#check that we can write to serversubprocess.check_output([str('aws'), 's3', 'cp', os.getcwd()+"/s3sec.txt", 's3://'+url+'/s3sec.txt', '--no-sign-request'],stderr=subprocess.DEVNULL)print(url+".s3.amazonaws.com [write]")#check that we can remove file from serversubprocess.check_output([str('aws'), 's3', 'rm', 's3://'+url+'/s3sec.txt', '--no-sign-request'],stderr=subprocess.DEVNULL)print(url+".s3.amazonaws.com [delete]")except:returnurls = []; c = 0
for line in sys.stdin:url = line.strip().replace("https://","").replace(".s3.amazonaws.com","").replace("s3.amazonaws.com/","")process(url)

使用s3sec批量化自动扫描S3存储桶泄露数据相关推荐

php aws s3查看所有文件_国内AWS没有文件系统服务，快来看如何通过EC2挂载S3存储桶替代...
作者:光环云尹晓征当有需求必须使用共享磁盘服务时,但目前AWS的EFS因为在国内落地的情况,只能通过自建诸如NFS或者GFS等服务来完成,整个过程比较繁杂. S3是互联网的一种存储解决方案,并且借 ...
bash脚本文件_如何使用Bash脚本来管理从AWS S3存储桶下载和查看文件
bash脚本文件 As you can read in this article, I recently had some trouble with my email server and deci ...
aws s3 静态网站_使用AWS S3存储桶启动静态网站
aws s3 静态网站 This article explores the AWS S3 bucket to configure a static website. 本文探讨了用于配置静态网站的AWS ...
aws rds监控慢sql_将AWS S3存储桶与AWS RDS SQL Server集成
aws rds监控慢sql This article gives you an overview of integrating AWS S3 buckets with AWS RDS SQL Serv ...
aws s3 cli_了解AWS CLI –使用AWS CLI与AWS S3存储桶进行交互
aws s3 cli It is the second article in the Learn AWS CLI series. It gives you an overview of working ...
ssis 循环导入数据_使用集成服务（SSIS）包从Amazon S3 SSIS存储桶导入数据
ssis 循环导入数据 This article explores data import in SQL Server from a CSV file stored in the Amazon S3 ...
python上传大文件s3_使用Python boto3上传Windows EC2实例中的文件至S3存储桶中
一.创建终端节点为什么要创建终端节点,把VPC和S3管理起来呢?如果不将VPC和S3通过终端节点管理起来,那么VPC中EC2实例访问S3存储桶是通过公共网络的:一旦关联起来,那么VPC中EC2实例访 ...
AWS Ec2实例挂载S3存储桶实践
AWS Ec2实例挂载S3存储桶实践 1.编译安装s3fs-fuse: 编译安装: sudo yum install -y automake fuse fuse-devel gcc-g++ git l ...
S3存储桶策略（S3 Bucket Policies）
关注公众号:AWS爱好者(iloveaws) 文 | 沉默恶魔(禁止转载,转载请先经过作者同意) 网站:www.iloveaws.cn S3存储桶策略(S3 Bucket Policies) [ Do ...

使用s3sec批量化自动扫描S3存储桶泄露数据

工具源码:

使用s3sec批量化自动扫描S3存储桶泄露数据相关推荐

最新文章

热门文章