Termux ID: AWS -->

    Social Items

Home / AWS

Find interesting Amazon S3 Buckets by watching certificate transparency logs.
This tool simply listens to various certificate transparency logs (via certstream) and attempts to find public S3 buckets from permutations of the certificates domain name.

Some quick tips if you use S3 buckets:
  1. Randomise your bucket names! There is no need to use company-backup.s3.amazonaws.com.
  2. Set appropriate permissions and audit regularly. If possible create two buckets - one for your public assets and another for private data.
  3. Be mindful about your data. What are suppliers, contractors and third parties doing with it? Where and how is it stored? These basic questions should be addressed in every info sec policy.

Installation
Python 3.4+ and pip3 are required. Then just:
  1. git clone https://github.com/eth0izzle/bucket-stream.git
  2. (optional) Create a virtualenv with pip3 install virtualenv && virtualenv .virtualenv && source .virtualenv/bin/activate
  3. pip3 install -r requirements.txt
  4. python3 bucket-stream.py

Usage
Simply run python3 bucket-stream.py.
If you provide AWS access and secret keys in config.yaml Bucket Stream will attempt to identity the buckets owner.
usage: python3 bucket-stream.py

Find interesting Amazon S3 Buckets by watching certificate transparency logs.

optional arguments:
  -h, --help           show this help message and exit
  --only-interesting   Only log 'interesting' buckets whose contents match
                       anything within keywords.txt (default: False)
  --skip-lets-encrypt  Skip certs (and thus listed domains) issued by Let's
                       Encrypt CA (default: False)
  -t , --threads       Number of threads to spawn. More threads = more power.
                       (default: 20)

F.A.Qs
  • Nothing appears to be happening
    Patience! Sometimes certificate transparency logs can be quiet for a few minutes.
  • I found something highly confidential
    Report it - please! You can usually figure out the owner from the bucket name or by doing some quick reconnaissance. Failing that contact Amazon's support teams.

Bucket Stream - Find interesting Amazon S3 Buckets by watching certificate transparency logs


One stop tool for auditing the security posture of AWS.

Pre-requisites
Python 2.7
pip
git

Installation
git clone https://github.com/SecurityFTW/cs-suite.git
cd cs-suite/
sudo python setup.py
Note - Generate a set of ReadOnly AWS keys which the tool will ask to finish the installation process.

Virtual Environment installation
(So you don't mess with the already installed python libraries)
pip install virtualenvironmentwrapper
add it to the respective rc file of your shell (bashrc/zshrc) (for fish shell users check virtualfish)
echo "source /usr/local/bin/virtualenvwrapper.sh" >> ~/.bashrc
source the file 
source ~/.bashrc
Run env: 
cd cs-suite/
mkvirtualenv cssuite
workon cssuite
pip install -r requirements-virtual.txt
aws configure
Once installation is done, the tool will ask you for the AWS keys and region. These two are mandatory for the tool to work.

Run
python cs.py

Documentation
https://securityftw.github.io/Docs/

Videos

 Installation and running CS Suite:

This is how you can audit a linux instance:

This is how you can audit a windows instance:


Cloud Security Suite - One stop tool for auditing the security posture of AWS infrastructure


AWSBucketDump is a tool to quickly enumerate AWS S3 buckets to look for loot. It's similar to a subdomain bruteforcer but is made specifically for S3 buckets and also has some extra features that allow you to grep for delicious files as well as download interesting files if you're not afraid to quickly fill up your hard drive.

Pre-Requisites
Non-Standard Python Libraries:
xmltodict
requests
argparse
Created with Python 3.6

General
This is a tool that enumerates Amazon S3 buckets and looks for interesting files.
I have example wordlists but I haven't put much time into refining them.
https://github.com/danielmiessler/SecLists will have all the word lists you need. If you are targeting a specific company, you will likely want to use jhaddix's enumall tool which leverages recon-ng and Alt-DNS.
As far as word lists for grepping interesting files, that is completely up to you. The one I provided has some basics and yes, those word lists are based on files that I personally have found with this tool.
Using the download feature might fill your hard drive up, you can provide a max file size for each download at the command line when you run the tool. Keep in mind that it is in bytes.
I honestly don't know if Amazon rate limits this, I am guessing they do to some point but I haven't gotten around to figuring out what that limit is. By default there are two threads for checking buckets and two buckets for downloading.
After building this tool, I did find an interesting article from Rapid7 regarding this research: https://community.rapid7.com/community/infosec/blog/2013/03/27/1951-open-s3-buckets

Usage:
usage: AWSBucketDump.py [-h] [-D] [-t THREADS] -l HOSTLIST [-g GREPWORDS] [-m MAXSIZE]
optional arguments: -h, --help show this help message and exit -D Download files. This requires significant diskspace -d If set to 1 or True, create directories for each host w/ results -t THREADS number of threads -l HOSTLIST -g GREPWORDS Provide a wordlist to grep for -m MAXSIZE Maximum file size to download.
python AWSBucketDump.py -l BucketNames.txt -g interesting_Keywords.txt -D -m 500000 -d 1


AWSBucketDump - Security Tool to Look For Interesting Files in S3 Buckets

Subscribe to: Posts (Atom)