AWS - S3 Unauthenticated Enum
Last updated
Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
A bucket is considered “public” if mtumiaji yeyote anaweza kuorodhesha maudhui ya bucket, and “private” if the bucket's contents can only be listed or written by certain users.
Companies might have buckets permissions miss-configured giving access either to everything or to everyone authenticated in AWS in any account (so to anyone). Note, that even with such misconfigurations some actions might not be able to be performed as buckets might have their own access control lists (ACLs).
Learn about AWS-S3 misconfiguration here: http://flaws.cloud and http://flaws2.cloud/
Different methods to find when a webpage is using AWS to storage some resources:
Using wappalyzer browser plugin
Using burp (spidering the web) or by manually navigating through the page all resources loaded will be save in the History.
Check for resources in domains like:
Check for CNAMES as resources.domain.com might have the CNAME bucket.s3.amazonaws.com
Check https://buckets.grayhatwarfare.com, a web with already discovered open buckets.
The bucket name and the bucket domain name needs to be the same.
flaws.cloud is in IP 52.92.181.107 and if you go there it redirects you to https://aws.amazon.com/s3/. Also, dig -x 52.92.181.107 gives s3-website-us-west-2.amazonaws.com.
To check it's a bucket you can also visit https://flaws.cloud.s3.amazonaws.com/.
You can find buckets by brute-forcing names related to the company you are pentesting:
https://github.com/jordanpotti/AWSBucketDump (Contains a list with potential bucket names)
Given S3 open buckets, BucketLoot can automatically search for interesting information.
You can find all the supported regions by AWS in https://docs.aws.amazon.com/general/latest/gr/s3.html
You can get the region of a bucket with a dig and nslookup by doing a DNS request of the discovered IP:
Check that the resolved domain have the word "website".
You can access the static website going to: flaws.cloud.s3-website-us-west-2.amazonaws.com
or you can access the bucket visiting: flaws.cloud.s3-us-west-2.amazonaws.com
If you try to access a bucket, but in the domain name you specify another region (for example the bucket is in bucket.s3.amazonaws.com but you try to access bucket.s3-website-us-west-2.amazonaws.com, then you will be indicated to the correct location:
Ili kujaribu ufunguzi wa ndoo, mtumiaji anaweza tu kuingiza URL katika kivinjari chao cha wavuti. Ndoo ya kibinafsi itajibu na "Access Denied". Ndoo ya umma itataja vitu 1,000 vya kwanza ambavyo vimehifadhiwa.
Open to everyone:
Private:
You can also check this with the cli:
Ikiwa bakuli haina jina la kikoa, unapojaribu kuhesabu, weka jina la bakuli tu na si kikoa zima cha AWSs3. Mfano: s3://<BUCKETNAME>
Inawezekana kubaini akaunti ya AWS kwa kutumia faida ya S3:ResourceAccount Key ya Masharti ya Sera. Masharti haya yanapunguza ufikiaji kulingana na baki ya S3 ambayo akaunti iko ndani (sera nyingine zinazotegemea akaunti zinapunguza kulingana na akaunti ambayo kiongozi anayehitaji yuko ndani).
Na kwa sababu sera inaweza kuwa na wildcards inawezekana kupata nambari ya akaunti nambari moja kwa wakati.
Chombo hiki kinara mchakato:
H technique hii pia inafanya kazi na API Gateway URLs, Lambda URLs, Data Exchange data sets na hata kupata thamani ya tags (ikiwa unajua ufunguo wa tag). Unaweza kupata maelezo zaidi katika utafiti wa asili na zana conditional-love ili kuendesha uhalifu huu.
Kama ilivyoelezwa katika hiki kipande cha blog, ikiwa una ruhusa ya kuorodhesha bucket inawezekana kuthibitisha accountID ambayo bucket inamilikiwa kwa kutuma ombi kama:
Ikiwa kosa ni "Access Denied" inamaanisha kuwa ID ya akaunti ilikuwa mbaya.
Kama ilivyoelezwa katika hiki kipande cha blogu, inawezekana kuangalia ikiwa anwani ya barua pepe inahusiana na akaunti yoyote ya AWS kwa kujaribu kutoa ruhusa kwa barua pepe juu ya S3 bucket kupitia ACLs. Ikiwa hii haitasababisha kosa, inamaanisha kuwa barua pepe hiyo ni mtumiaji wa mzizi wa akaunti fulani ya AWS:
Jifunze & fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Jifunze & fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
